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Abstract 

We consider a Shannon cipher system for memoryless sources, in which distortion is allowed at the legitimate 
decoder. The source is compressed using a rate distortion code secured by a shared key, which satisfies a constraint 
on the compression rate, as well as a constraint on the exponential rate of the excess-distortion probability at 
the legitimate decoder. Secrecy is measured by the exponential rate of the exiguous-distortion probability at the 
eavesdropper, rather than by the traditional measure of equivocation. We define the perfect secrecy exponent as the 
maximal exiguous-distortion exponent achievable when the key rate is unlimited. Under limited key rate, we prove 
that the maximal achievable exiguous-distortion exponent is equal to the minimum between the average key rate 
and the perfect secrecy exponent, for a fairly general class of variable key rate codes. 

Index Terms 

Information-theoretic secrecy. Shannon cipher system, secret key, cryptography, lossy compression, rate-distortion 
theory, error exponent, large-deviations, covering lemmas. 

I. Introduction 

In his seminal paper |[T]|, Shannon has introduced a mathematical framework for secret communication. The 
cipher system is considered perfectly secure if the cryptogram and the message are statistically independent, and 
so, an eavesdropper does not gain any information when he observes the cryptogram. To achieve secrecy, the sender 
and the legitimate recipient share a secret key, which is used to encipher and decipher the message. It is rather 
apparent from ordinary compression 121 that a necessary and sufficient condition for perfect secrecy is that the 
available key rate is larger than the information rate required to compress the source (the entropy or rate-distortion 
function of the source in case of lossless or lossy compression, respectively). Usually, the supply of key bits is a 
limited resource, as they need to be transferred to the intended recipient via a completely secure channel. When 
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the key rate is less than the information rate, secrecy is traditionally measured in terms of equivocation, that is, 
the conditional entropy of the message given the cryptogram. The use of equivocation as a secrecy measure was 
advocated hy other models of secrecy systems, which do not assume a shared key. Instead, secrecy is achieved hy 
the fact that the message intercepted hy the eavesdropper is of lower quality than the one received hy the legitimate 
receiver. For example, in the ubiquitous wire-tap model IS, 0, the channel of the wiretapper is degraded (or more 
noisy) with respect to (w.r.t.) the channel of the legitimate receiver. In the model of ||5l, ill, 171 the legitimate 
recipient has better quality of side information than the eavesdropper. 

The equivocation is indeed an unambiguous measure for statistical dependence when it is equal to either its 
minimal value of zero (the random variables are deterministic functions of each other), or its maximal value of the 
unconditional entropy (the two random variables are independent). Nonetheless, for partial secrecy, i.e., when the 
equivocation takes values strictly between these two extremes, its operational meaning is disputable. Thus, in HI, 
it was proposed to measure partial secrecy by the expected number of spurious messages that explain the given 
cryptogram (which is somewhat equivalent to the probability of correctly decrypting the message). Later, in 0, 
it was proposed to measure partial secrecy by the minimum average distortion that an eavesdropper can attain 
(this was also considered previously, to some extent, in lITOl ). In addition, in 0 the possibility that the legitimate 
recipient can tolerate a certain distortion level was also incorporated into the system model. In 0 Theorems 2 and 
3], inner and outer bounds were obtained on the achievable trade-off between the coding rate, the key rate, and 
distortion levels at the legitimate recipient and eavesdropper. However, in ifTTI . it was revealed that this trade-off 
is, in fact, degenerated. It was demonstrated there that in some cases, a negligible key rate can cause maximum 
distortion at the eavesdropper. The following simple example (from ifTll Section I.A]) demonstrates this: Consider 
an memoryless source X = (Xi,..., X„) G {0,1}"^ where P(Xj = 1) = ^ for i = 1,... n, and a single key bit U, 
shared by the two legitimate parties, where F{U = 1) = |. Suppose that the distortion measure at the eavesdropper 
side is the Hamming distortion measure. Then, if the encrypted message is Y = (Yi,..., Yn), where Yj = Xj © U, 
then the distortion at the eavesdropper attains its maximal possible value of regardless of the estimate of the 
eavesdropper. Nonetheless, such a secrecy is severely insecure. If the eavesdropper becomes aware of just a single 
bit of the source, then it can decrypt the entire message. It was therefore proposed to consider models which are 
more robust to assumptions concerning the eavesdropper. These models indeed lead to a non-degenerated trade¬ 
off, that requires a positive key rate. In ifTlIl . |[T3l it was assumed that the eavesdropper’s estimation is performed 
sequentially, and at the time it estimates the i-th symbol, it has noiseless/noisy estimates of all the previous message 
symbols and the previous reproduced symbols (at the legitimate recipient), in addition to the public cryptogram. This 
model was termed causal disclosure. It was justified by the scenario in which the sender and legitimate recipient 
attempt to coordinate actions in a distributed system in order to maximize a certain payoff, and the eavesdropper 
acts in order to minimize the payoff. In a different line of work O, the eavesdropper produces a fixed-size lisf 
(of exponential cardinalify in fhe block-lengfh), and fhe disfortion is measured w.r.f. fhe reproduction word in fhe 
lisf which affains fhe minimal disfortion. 
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However, the fact that the trade-off in 0 is degenerated can he attributed to the way that the distortion is 
measured, rather than to the weakness of the eavesdropper. For a given strategy of the eavesdropper, the average 
distortion, as assumed in 0, llT2l . ifldll . may he large due to message and key-hit combinations that lead to a very 
large distortion, albeit with small probability. A more refined figure of merit would include the probability that the 
distortion is less than some level, rather than the average distortion. Such a performance criterion is customary in 
ordinary rate-distortion theory (e.g. the e-fidelity criterion in ifTSl Chapter 7]). Indeed, in the above single key-bit 
example, the eavesdropper can estimate the message exactly with probability irrespective of its length. Thus, for 
any positive distortion level, the probability of an exiguous-distortion event is i, which is clearly unacceptable for 
most applications. 

For most source models, good estimation of the message at the eavesdropper should be a rare event, and finding 
ifs exacf probability is difficult. Instead, an asymptotic analysis can be carried in order to find the exponential 
decrease rate (i.e. the exponent) of the correct decryption probability. The results of ifTOl can be considered as 
a special case of this line of thought, for the restricted class of instantaneous encoders. In ifTOl . the exponent of 
decrypting the message by the eavesdropper was found as a function of the exponent of exiguous-distortion of the 
estimation by the eavesdropper. For the same model, the exponent of the minimal probability of correct decryption 
by the eavesdropper was found in |[T6l . Later, in ifTTIl secrecy was defined in a large-deviafions sense: A system 
is considered secure if the exponent of the probability of the eavesdropper correctly decrypting the message is the 
same with and without the cryptogram. This, in turn, required the analysis of the correct decryption probability. In 
m, HU, El, it was assumed that the legitimate recipient must reproduce the message exactly (i.e., with zero 
distortion). 

In this paper, we adopt a similar large-deviations approach to measuring secrecy, using a distortion measure, 
and generalize the results of El . For a memoryless source, we allow an imperfect reproduction at the legitimate 
recipient, and measure distortion both at the legitimate recipient and at the eavesdropper using a large-deviations 
measure. Specifically, we will define two exponents. First, for a given distortion level Dl, the excess-distortion 
exponent is defined in the usual way El Chapter 9], as the exponent of the probability that the distortion between 
the legitimate recipient reproduction and the source sequence is larger than D^. Second, for a given distortion 
level De, we define the exiguous-distortion exponent as the exponent of the probability that the distortion between 
the eavesdropper estimate and the source sequence is less than Dg. We will derive the perfect secrecy exponent 
function 77*(Dg), which is the exiguous-distortion exponent of the eavesdropper when it estimates the message 
blindly, without the cryptogram (alternatively, for codes with unlimited key rate). It will be assumed that the 
secrecy system has a limited coding rate Rl, and that for a given distortion level Dl, the excess-distortion exponent 
must be larger than El. Our main result is that under mild conditions on the compression constraints (Rl, Dl, El), 
the maximal achievable exiguous-distortion exponent is equal to the minimum between the key rate R, and 77* (Dg), 
calculated at distortion level required by the eavesdropper Dg. Since this maximal exiguous-distortion exponent 
does not depend on (Rl, Dl, El) (in the interesting domain of these parameters), such a result implies that as far as 
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Figure 1. Two cases of ambiguity for the eavesdropper, for a single key bit code. Left side: Assume for simplicity that the source is 
distributed uniformly over the dots encapsulated by the outermost circle. The two small solid line circles represent two reproduction cells, 
which are mapped to the same cryptogram by the two possible values of the key bit u. The dashed larger circle represents all the source 
block for which the distortion between the source block and the best estimate of the eavesdropper is less than Dr. As can be seen, there 
is a large exiguous-distortion probability. Right side: Under the same assumptions, in this case the two reproduction cells are far apart. The 
best estimate of the eavesdropper can ‘cover’ at most one of the reproduction cells, and the exiguous-distortion probability is i. 

performance trade-offs are concerned, the compression and secrecy problems are essentially decoupled: The fact 
that the message is required to be kept secret does not affect the compression performance. It should be stressed, 
however, that this result does not imply a separation theorem from the operational point of view. The rate-distortion 
code should be designed in a certain manner in order to provide secrecy, in contrast to, e.g., 0, m, m. A 
concatenation of an arbitrary good rate-distortion code, followed by encryption using the available key bits, does 
not necessarily achieve a good exiguous-distortion exponent. For intuition, consider an ordinary rate-distortion code, 
assume that one key bit is available, and that the distortion measures of the legitimate decoder and eavesdropper 
are the same. The eavesdropper, in this case, knows that the reproduction of the legitimate decoder is one of two 
possible reproductions (of equal probability). If these two reproductions are close, then it can approximate them 
using a single reproduction, and achieve a distortion which may be only slightly larger than the distortion of the 
legitimate decoder. If, however, the rate-distortion code is designed in such a way that these two reproductions 
are sufficiently far apart, then the eavesdropper will have a poor compromise between them, and will achieve 
high distortion. This is illustrated in Figure [T] More generally, unlike ordinary rate-distortion codes, in which the 
performance is determined only by the reproduction cells, and the way in which the reproduction cells are mapped 
to transmitted bits is immaterial, here, the latter will be crucial for the security performance. 

To show this result, we will prove both achievability (lower bound on the exiguous-distortion exponent) and a 
matching converse (upper bound). In the achievability part, we will demonstrate the existence of a secrecy system 
in which the compression constraints are satisfied, and if has a fixed key rafe R. For fhis secrecy sysfem, fhe besf 
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Strategy of the eavesdropper will be either to (1) guess the secret key and reproduce the message as a legitimate 
recipient (using the cryptogram), or (2) blindly estimate the message. The secrecy system constructed will also be 
universal in the following two senses. First, it does not require the knowledge of the source statistics, as long it 
is a memoryless source. Second, it is not designed for a specific value of Dg, yet the exiguous-distortion exponent 
min{R, i?*(DE)} will be achieved for any value of Dg, by the same sequence of codes, as long as Dg > Dl. As a 
converse, we will show that even if variable key rate is allowed, yet with average key rate less than R, then the 
exiguous-distortion exponent cannot be larger than min{R, S*(De)}. The results of IITtI are essentially recovered 
from our results, as a special case with Dl = Dg = 0. We also remark that in our model, the distortion measures 
of the legitimate recipient and the eavesdropper can be different, as long as they satisfy a certain relationship. 

Finally, we briefly mention a related work in which large-deviations aspects were also incorporated. In |[T9l . 
the guessing model of EOl . 11211 was relaxed to allow, after a maximum of possible guesses has passed, a small 
probability of large distortion for the eavesdropper. To analyze the asymptotic limits of the system, the excess- 
distortion exponent of the eavesdropper was restricted, and the maximal normalized logarithm of the number of 
guesses was founcj^. However, in our model, no testing mechanism is assumed to be available to the eavesdropper, 
which allows it to validate its estimate. 

The outline of the rest of the paper is as follows. In Section ini we establish notation conventions, and in Section 
mn we formulate the problem. In Section |IVl we present our main theorem, and discuss its implications. In Section 
rvl we provide the outline and the main ideas of the proof. The proof of the main theorem appears in Section |Vll 

II. Notation Conventions 

Throughout the paper, random variables will be denoted by capital letters, specific values they may take will 
be denoted by the corresponding lower case letters, and their alphabets will be denoted by calligraphic letters. 
Random vectors and their realizations will be denoted, respectively, by capital letters and the corresponding lower 
case letters, both in the bold face font. Their alphabets will be superscripted by their dimensions. For example, the 
random vector X = {X\, ..., Xn) (n positive integer), may take a specific vector value x = (xi,..., x„) in A’"', 
the nth order Cartesian power of X, which is the alphabet of each component of this vector. For any given vector 
X, we will also denote x^ = {xi, Xj) for 1 < i < j < n, and use the shorthand x-^ = xT 

We will follow the standard notation conventions for probability distributions, e.g., Px{x) will denote the 
probability of the letter x € X under the distribution Px- The arguments will be omitted when we address 
the entire distribution, e.g., Px- Similarly, generic distributions will be denoted by Q, Q*, and in other forms, 
subscripted by the relevant random variables/vectors/conditionings, e.g. Qxz, Qx\z- Whenever clear from context, 
these subscripts will be omitted. An exceptional case will be the ‘hat’ notation. For this notation, Qx will denote 

'Reference GD is a one page abstract, and contains only a description of the problem. The results were not published, but a detailed 
version of GD can be found in GH. However, we believe that the achievability results provided in GH are not actually proven. Specifically, 
in the achievability proof, no system is actually constructed, and the claims about the expected number of guesses of the eavesdropper are 
made on any given secrecy system. Obviously, there are, particularly bad, secrecy systems, in which a single guess suffices to find the 
message exactly. 
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the empirical distribution of a vector x € X'^, i.e., the vector of relative frequencies Q:x_{x) of each symbol x € X 
in X. The type class of x £ X^, which will be denoted by Tn{Qx), is the set of all vectors x' with Qx' = Qx- The 
set of all type classes of vectors of length n over X will be denoted by Vn{X), and the set of all possible types 
over X will be denoted by V{X) = {J^^iVniX). Similar notation for type classes will also be used for generic 
types Qx S T’(T’), i.e., Tn{Qx) will denote the set of all vectors x with Qx = Qx- In the same manner, the 
empirical distribution of a pair of vectors (x, z) will be denoted by Qxz and the joint type class will be denoted 
hy TniQxz)- The joint type classes over the Cartesian product alphabet X x Z will be denoted by Vn{X x Z), 
and V{X x Z) = IJ^i 'PniX x y). For a joint type Qxz € V{X x Z), Tn{Qxz) will denote the set of all pairs 
of vectors (x, z) with Qxz = Qxz- The conditional type class, namely, the set {x' : Qx'z = Qxz}^ will be denoted 
hy 7jj(Qx|z) 2 ;), or more generally Tn{Qx\Zi'^) lor a generic empirical conditional probahility distribution Qx\z- 
The probability simplex for X will be denoted by Q(X), and the simplex for the alphabet X x Z will be denoted 
by Q{X X Z). Similar notations will be used for triplets of random variables. 

For two distributions Px, Qx over the same finite alphabet X, we will denote the variational distance {Ci norm) 

by 

\\Px - Qx\\-'^\Px{x) - Qx{x)\. (1) 

x^X 

When optimizing a function of a distribution Qx over the entire probability simplex Q(X), the explicit display of the 
constraint will be omitted. For example, for a function f{Q), we will write minQ f{Q) instead of f{Q)- 

The same will hold for optimization of a function of a distribution Qxz over the probability simplex Q{X x Z), 
and for similar optimizations. 

The expectation operator w.r.t. a given distribution, e.g., Qxz, will be denoted by Eq[-] where, the subscript 
Qxz will be omitted if the underlying probability distribution is clear from the context. In general, information- 
theoretic quantities will be denoted by the standard notation with subscript indicating the distribution of the 
relevant random variables, e.g. Hq{X\Z), Iq{X\ Z),Iq{X-, Z\W), under Q = Qxzw- For notational convenience, 
the entropy of X under Q will be denoted both by Hq{X) and H{Qx), depending on the context. The binary 
entropy function will be denoted by hsiq) for 0 < g < 1. The information divergence between two distributions, 
e.g. Px and Qx, will be denoted by D{Px\\Qx)- In all information measures above, the distribution may also be 
an empirical distribution, for example, H{Qx), D{Q:x.\\Px) and so on. 

We will denote the Hamming distance between two vectors, x £ X^ and z £ X^, by d„{x,z). The length of 
a string b will be denoted by \b\, the concatenation of strings 61 , 62 , • • • will be denoted by {bi,b 2 , ■ ■.), and the 
empty string will be denoted by cj). We will denote the complement of a set A by A'^, and its interior by int(^). 
For a finite set A, we will denote its cardinality by |^|. The probability of the event A will be denoted by P(^), 
and I(w4) will denote its indicator function. 

For two positive sequences, {an} and {bn} the notation = bn, will mean asymptotic equivalence in the 
exponential scale, that is, lim^^oo = 0- Similarly, Un < bn will mean limsup^^go < 0, and 
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SO on. The ceiling function will be denoted by [•]. The notation will stand for max{f,0}. For two integers, 
a, b, we denote by a mod h the modulo of a w.r.t. b. Logarithms and exponents will be understood to be taken to 
the binary base. 

Throughout, we will ignore integer code length constraints for the sake of simplicity, as they do not have 
any effect on the results. For example, instead of [nR] bits we will write nR bits. For a given finite ordered 
set, A = {ai,..., a|^|}, we will denote by ]B[a; log|./l|] the binary representation of the index of a in A, i.e. 
]B[a; log|^|] = z if a = aj, for z = 1 ,... 

In general, the subscript ‘L’ will be used for quantities related to the legitimate decoder, and the subscript ‘E’ 
will be used for eavesdropper-related quantities. 


III. Problem Statement 


Let the source vector X = (Xi,... ,X„) be formed by n independent copies of a random variable X G X, 
where X is a finite alphabet, and Xj is distributed according to Px{x) = P(X = x). Let W and Z be finite 
reproduction alphabets. In addition, let be a sequence of purely random bits (i.e. a Bernoulli process with 

P(f7j = 1) = ^), independent of the source X. 

A secure rate-distortion code Sn = (/n, ^n) of block-length n is defined by a key-length function kn '■ X” 
which assigns a key length /cn(x) to every x G X”, an encoder /„ : X” x {0,1}* ^ which generates 
a cryptogram, y = /„(x, u), where u = (zzi,..., ^nd where is a finite alphabeo and a legitimate 

decoder <fn-yn^ {0,1}* —> VV”^, which generates a reproduction w = A sequence of codes {<Sn}n>i, 

indexed by the block-length n, is denoted by S. The performance of the legitimate decoder is evaluated by a 
distortion measure di^ : A x W ^ M+, where without loss of generality (w.l.o.g.), it is assumed that for every 
X G X, there exists zu G W such that di^{x,w) = 0. Also, with a slight abuse of notation, the distortion between x 
and w is defined as the average. 


dL(x,w) = di^{xi,Wi). 


2 = 1 


We say that S satisfies a compression constraint (Rl, Dl, El), if the coding rate satisfied 


( 2 ) 


limsup-log|Xn|< Rl, 

n^oo 


(3) 


and for any given the excess-distortion exponent, at distortion level Dl, is larger than El for 

the legitimate decoder, i.eO 


lim inf - -P [c^L (X, (X,u),u)) > DJ > El. (4) 

n—>-oo ji 

^This alphabet need not be the nth order Cartesian power of some alphabet y. 

^It is implicit in the definition of the encoder and decoder that both are aware of the key-length fcn(x). Specifically, one can define an 
inverse-key length function In '■ yn x {0,1}* —>■ Z+, which reproduces the key-length at the decoder side, i.e. kn{x.) ~ ln{y, {trifSi)- 
^This constraint can be weakened to a constraint on the normalized entropy of the cryptogram. See discussion in Section EYl 
^This constraint can be weakened to be only satisfied for an excess-distortion probability averaged over See discussion in Section 
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Note that for a zero excess-distortion exponent El = O'*', this requirement implies that an average-distortion 
constraini^ E[dL(X, W)] < Dl is also satisfied. An eavesdropper decoder is a function cr„ : —)■ where 

z = CTniv) is the estimate of the eavesdropper. It is assumed that the eavesdropper has full knowledge of all system 
properties: The source statistics, the encoder (/n,A:„), and the legitimate decoder (/?„. The set of all eavesdropper 
decoders for a hlock-length n is denoted hy In what follows, we also consider genie-aided eavesdropper 
decoders, which are aware of the type class of the source block, i.e., : 3 ^n x T’n —^ A”", and in this case, the 

estimate of the decoder is z = d'„(y,Qx)- The set of all genie-aided eavesdropper decoders of hlock-length n is 
denoted hy 

The performance of the eavesdropper is evaluated hy a distortion measure : X x Z ^ M+, where again, it is 
assumed that for every x € A, there exists z ^ Z such that d^{x, z) = 0. As before, the distortion between x and 
z is defined as 

1 

dE(x, z) = - d^{xi, Zi). (5) 


i=l 


For a given Dg > 0, fhe exiguous-distortion probability, for a given code Sn, is denofed by 


Pd{Sn-, De) = max P [^(X, Z) < De] . ( 6 ) 

The limit inferior exiguous-distortion exponent, achieved for a sequence of codes S, is defined as 

£f{S, De) = liminf--logpd(5n, De), (7) 

“ n^oo n 

and fhe limit superior exiguous-distortion exponent achieved, £’j“ (5, De), is defined analogously, wifh limif superior 
replacing fhe limif inferior. While, £f{S, De) < £^^5, De), it is guaranteed that Pd{sn, De )>exp [-n£^ {S, De)] 
for all sufficiently large block-lengths, while Dg) = exp [—n£^j'(5, De)] may hold only for some sub¬ 

sequence of block-lengths. Thus, £f{S, De) is less sensitive to the choice of the block-length. For a given Qx G 
V{X), let ni = uqI, f = 1,2 ,..., be the sub-sequence of block-lengths such that Tn{Qx) is non-empty, where 
no is the minimal such block-length. We define, wifh a slighf abuse of nofafion, fhe conditional limit inferior 
exiguous-distortion exponent as 

£’^-(5,De,Qx) = liminf--log max P [^(X, Z) < De|X e rn,(Qx)] , ( 8 ) 

1^00 ni 

and De,Qx) is defined analogously. 

The key rale of x G X^ is defined as r„(x) = T |fc„(x)|. A code is termed a fixed key rate code of rate Rq 

^Indeed, suppose that P (dL(X, (/p„(/„(X, u), u)) > Dl) decays to zero for all , but only sub-exponentially. Assuming dr — 

miniugvv raaxxex drfa:, w) < oo, for any d > 0 and all n sufficiently large 

E[dL(X,W)] < DL-P[dL(X,v9„(/,,(X,u),u)) < DlI-H dL-P[dL(X,(p„(/„(X,u),u)) < Dl] 

< DL + dr -PldLfX, v3„(/„(X,u),u)) < Dl] 

< Dl -f d. 



if rji(x) = Rq for all x e A”", otherwise, it is called a variable key rate code, and it has an average key rate 
E[rn(X)]. We define the conditional key rate of Qx € V{X) as 

R{S,Qx) = lim EK(X)|X € UQx)] (9) 

1^00 

whenever the limit exist. 

The rate-distortion function of a memory less source Qx, under the distortion measure is denoted hy 


Rl{Qx,DQ 


min Iq{X-,W) 

Qw|x:EQ[dL(WVF)]<DL 


( 10 ) 


and, similarly, the rate-distortion function of Qx under the distortion measure dE{-, •) is denoted hy Re{Qx, De)- 
The main result of this paper, in Theorem [T] is a single-letter formula for the largest achievable exiguous-distortion 
exponent for codes under a compression constraint (Rl, Dl, El) and limited key rate. 


IV. Main Result 

The achievahility part will he proved using fixed key rafe codes, huf in fhe converse part, we will allow also 
variable key rafe codes, fhaf satisfy fhe following assumptions: 

1) Upper bound on the key rate: As fcn(x) = nloglT”! key-bifs are always sufficienf fo perfecfly encrypf fhe 
source, even wifhouf distortion, if will be assumed fhaf A:„(x) < nlog \ X\ for all x G 

2) Uniform convergence of the conditional key rate: We assume fhaf for every Qx G V{X), conditioned on 
X G TniQx), the key rafe rn(X) converges in probabilify fo R{S,Qx), and moreover, fhis convergence is 
uniform over V{X). Namely, for any 5 > 0 

max P [|r„(X)-i?(5,gx)I ><)|XG r„(gx)] -^ 0 . (11) 

Qx^'Pni^) n—^oo 

If is easy fo prove fhaf since 0 < r,i(X) < logl/Tl wifh probabilify 1, fhen uniform convergence in fhe mean 
{Cl norm) is also satisfied, and fhe limit in ([Hi exists, uniformly over Qx G V{X). 

3) Admissible encoders: An encoder /„ will be termed admissible, if u 7 ^ u' implies that /n(x, u) 7 ^ /n(x, u') 
for all X G We assume that /„ is an admissible encoder. 

In addition, we make two more assumptions. These assumptions are inessential, and are only made in order 
to simplify the exposition of our results. 

4) Upper bound on the legitimate excess-distortion exponent: It is well known ifTSl Theorem 9.51. ll24]l . that for 
a given Dl, if 

liminf - log|>’n|> Rl (12) 

n^oo Tl 

then there exist a sequence of codes S which satisfies the compression constraint (Rl, Dl, El) iff 

El < Ee{Px, Dl, Rl) = mf D{Qx\\Px), 

Qx:Rl(Qx,Dl)>Rl 


( 13 ) 
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where Ei^{Px, Dl, Rl) is known as Marton’s source coding exponent. It will be assumed that the required 
excess-distortion exponent at the legitimate decoder is strictly positive and not larger than Marton’s exponent, 
i.e., 0 < El < Ei^{Px, Dl, Rl)- 

5) Partial ordering between distortion measures: The distortion measure will be termed more lenient 

than if for every w G W”, there exists z G Z” such that 

{x G : ^lCx, w) < D} C {x G X^ : z) < D} , (14) 

for every D > 0. This corresponds to a worst case assumption regarding the distortion measure (and the 
reproduction alphabet Z) used by the eavesdropper - it is at least not more demanding than the distortion 
measure used by the legitimate decoder. In addition, this also puts, in some sense, the distortion levels at 
the legitimate decoder and at the eavesdropper decoder, on the same scale. Therefore, it will be assumed 
that De > Dl, namely, the distortion level allowed by the eavesdropper is larger than the one allowed by the 
legitimate decoder. It is also easily verified that this assumption implies 

f?E(Qx,D) <i?L(Qx,D) (15) 


for every D > 0. 

We denote by 

T;:(De) = mm{D{Qx\\Px) + Re{Qx. De)} (16) 

Qx 

the perfect-secrecy exponent. Using standard method of types, it can be shown that this is the maximal exiguous- 
distortion exponent that can be achieved when the eavesdropper blindly estimates the source, i.e. without using the 
cryptogram. Alternatively, as evident from Theorem [T] this is the maximal exponent for unlimited key rate. We are 
now ready to state our main result. 

Theorem 1. Let 5 > D be given. Then, there exists a sequence of codes S of fixed key rate R, which satisfies a 
compression constraint (Rl -|- 5, Dl, El) and properties 1-5 above, 

£f{S, De) > min{R,E:(DE)} - <5 (17) 

for all De > Dl. Conversely, for every sequence of codes S of average key rate E[rn(x)] < R for all n, which 
satisfies a compression constraint (Rl, Dl, El) and properties 1-5 above, 

^+(5,De) <min{R,T;:(DE)} (18) 

for all De > Dl. 

Section |Vl] is devoted to the proof of Theorem [T] and here we discuss its implications. The main implication 
of this theorem is that the performance of lossy compression and encryption are essentially decoupled. Note that 
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in Theorem [T] the exiguous-distortion exponent of the eavesdropper is determined solely hy the key rate and 
the distortion level Dg at the eavesdropper, and not hy the compression constraint (Rl, Dl, El) (as long as the 
assumptions hold). Specifically, it holds for Dl = 0, which means that increasing Dl does not increase Dg. In other 
words, reducing the amount of information sent to the legitimate decoder cannot improve secrecy. Nonetheless, on 
a positive note, as long as R <El (De), the maximal secrecy can he attained, for every Dg > Dl, without affecting 
the compression performance. In addition, note that in Theorem [T] Dg has a special stature: A single sequence of 
codes S is universal for all De > Dl. This enables the construction of secure rate-distortion codes that are robust 
to the choice of De, which may be unspecified when designing fhe system. 

As previously mentioned, the achievability part of Theorem [T] is proved using fixed rate codes. Since fixed rate 
codes clearly satisfy the second assumption above, the maximal exiguous-distortion exponent is fully characterized 
for fixed key rafe coding. Furthermore, the theorem shows that variable key rate codes, from the class of codes 
which satisfy the above assumptions, offer no advantage over fixed key rate codes in terms of exiguous-distortion 
exponent. This is in contrast to similar problems (variable-rate channel coding with feedback |[25l . Il26l . variable-rate 
Slepian-Wolf coding ll27l '). where the more lenient average-rate constraint allows to increase the error exponent. It 
should be mentioned that while the class of variable key rate codes is restricted to satisfy uniform convergence in 
probability of the conditional key rate (see the second assumption above), the important class of type dependent 
variable key rate codes satisfy this assumption. In a type dependent variable key rate code, the key rate r„(x) 
depends on x only via its type, namely, Qx = Qs^ implies r„(x) = r„(x) = p{Qx) for some key rate function 
p{-) : V{X) —>■ R+. Due to the symmetry of source blocks from the same type class, such a key rate allocation is 
indeed plausible, and also practically motivated due to its simplicity. Such codes trivially satisfy the convergence 
requirement, and so the converse part of Theorem [T] is valid. 

Theorem [T] essentially generalizes IITtI Theorem 1]. In IITtI . it was assumed that all alphabets are identical 
X = W = Z, and that De = Dl = 0. Thus, the legitimate decoder need to perfectly reproduce the source block, 
and the eavesdropper performance is measured by its probability of correct estimate, i.e. 

Pd{Sn, De) = max P(X = Z). (19) 

Note also that for this specific case, fhe perfecf-secrecy exponent for this case is given by 

E:(De) = mm{D{Qx\\Px) + H{Qx)} (20) 

Qx 

= — logmaxPx(3:). (21) 

Indeed, even without using the cryptogram, the eavesdropper can choose z = {x*,...,x*) where x* = Px{x), 

and achieve ^^^(De). 
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V. Outline OF THE Proof OF Theorem [H 

Since the proof of Theorem [T] is considerably involved, this section is devoted to an informal description of the 
structure and the main ideas in this proof. Hopefully, this will facilitate the reading of the formal proof, or at least 
give the reader an idea of the main highlights. 

To begin, we observe, in Subsection IVI-Al that the exiguous-distortion exponent remains unchanged even if 
the eavesdropper is aware of the type of the source block Qx- This enables us to first, consider each type of the 
source separately, and only then incorporate all types simultaneously, both in the achievability and the converse 
parts. Next, in Subsection IVI-Bl we provide a technique which facilitates the construction of secure rate-distortion 
codes, such that in view of the eavesdropper the cryptograms are symmetric. The idea is to cover a type class 
Tn{Qx) using an essentially minimal number of permutations of a constituent set C Tn{Qx)- To wit, if 
Vn = {x(0 ),... ,x(|T>„| —1)} then for any permutation vr over {!,... ,n}, we define 

= {7r(x(0)),... ,7r(x(|T>„|-l))} , (22) 

and then find a set of permutations {7:n,t}t=o 

U 7rn,t{Vn) = TniQx), (23) 

t=0 

where Kn is asymptotically close to its minimal value of ■ For ordinary rate-distortion, such covering lemma 

can be used to show the existence of a good rate-distortion code (e.g. instead of ifTSl Lemma 9.1]). Let us define, 
fhe D-cover of w S W” as 


®(w,Qx, Dl) = {x G TniQx) ■ Ti^,w) < Dl} . (24) 

If we sef Vn = S(w, Qx, Dl) and find permutations {TTn,t}t=o (l2^ holds, then the set = {'r'n,ti^)}t=o 

is a rate-distortion code such that for every x € TniQx) there exists w ^ Cn such that dL(x, w) < Dl. Such 
permutations can be found for all types of the source, and using the method of types, it can be verified that Marton’s 
source coding exponent can be achieved by such a construction. For the construction of secure rate-distortion codes, 
we will use permutations of more complicated sets to cover the type. 

The achievability part (lower bound) is proved in Subsection IVI-CI using codes of fixed key rate R. Let us 
first focus on a single type Qx- For the legitimate decoder, a source block x G TniQx) is reproduced by some 
w ^ Cn — {^PniyjT) : y G G {0,1}”^}, which satisfies dL(x,w) < Dl, unless no such w exists. The 

compression constraint (Rl, Dl, El) ensures that large-distortion reproduction occurs with an exponentially decaying 
probability. The eavesdropper, on the other hand, reproduces using only the cryptogram y. With a slight abuse of 
notation of (1241) . let us define, for a given the D-cover of C as 

S(C„,Qx,Dl)^ U T)(w,Qx,Dl). 

wGC„ 


( 25 ) 
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When the eavesdropper observes y, it knows that the legitimate decoder will reproduce w from the set Cn{y) = 
u) : u e {0,1}"^^} of size \Cn{y)\= 2*^^. Furthermore, conditioning on the cryptogram y and the type Qx, 
the source block X is distributed uniformly over S(Cn(y), Qxj Dl). The proof of achievability is divided into 
three steps. In the first step (Lemma |7]), we demonstrate the existence of a good and secure rate-distortion code 
conditioned on a single cryptogram, in the second step, we extend this code for an entire type class Tn{Qx) 
(Lemma |9ll, and in the third step, we extend it to all types. 

In more detail, the first step of the proof (Lemma |7]) shows, by a random selection mechanism, that there 
exists a set C* of size 2^^^ such that when X is distributed uniformly over 2)(C*, Qx, DL)^ the exiguous-distortion 
probability of any eavesdropper is asymptotically not larger than Geometrically, this implies 

that the D-covers for w ^ Cn are distant from each other, under Thus, a secure rate-distortion code satisfying 

Cn{y) = C* for some cryptogram y, will have a good conditional exiguous-distortion probability given y. 

In the second step, we define the code for all x G Tn{Qx), using a symmetry argument. Observe that the 
distortion measures of both the legitimate and eavesdropper decoders are invariant to permutations (see Q and 
(l5]l). Thus, T)(7r(Cn), Qjv, Dl) = vr (2)(Cn, Qx, Dl)), and the exiguous-distortion probability for an eavesdropper 
when X is distributed uniformly over tt {'S){Cn, Qx, Dl)) is the same as for S(Cn, Qx, Dl). In Lemma 0 we use a 
minimal number of permutations (from Subsection IVI-BI ) of a good D-cover Qx, Dl) to cover Tn{Qx), and 
then obtain a good secure rate-distortion code for all Tn{Qx)- There is a certain subtlety in the proof of Lemma 
0 For an ordinary rate-distortion code, there might be more than a single w G Cn such that dL(x, w) < Dl. From 
the excess-distortion probability point of view, there is no importance to which one of these {w} will reproduce 
X. However, this might result in w G for which only a small portion of T)(w, Qx, Dl) is actually reproduced 
by w (as X G T)(w,Qx, Dl) might be reproduced by some w' G Cn which also satisfies dL(x, w) < Dl), which 
might be harmful for secrecy purposes. Indeed, the secure rate-distortion code is constructed in Lemma |9] with 
the will that conditioned on any cryptogram y, the source is distributed uniformly over 0(C*,Qx, Dl). But, since 
a source block must eventually be reproduced by a single w, then conditioned on some of the cryptograms y, 
the source block will be distributed on a smaller set than S)(C*,Qx, Dl). For such cryptograms, the conditional 
exiguous-distortion probability of the eavesdropper might be large. Lemma shows that if the efficient covering 
described above is utilized, then the total effect of such events is negligible. 

Until this stage, we have constructed a code for Tn{Qx) with appropriate conditional exiguous-distortion ex¬ 
ponent. As we shall see, in the construction of Lemma |7] and Lemma |9j the convergence of probabilities to their 
asymptotic exponent is not necessarily uniform (cf. Remark [8]l. In the third step of the achievability proof, we prove 
that uniform convergence is possible, using an elaborated construction, built from the previous one. The idea is to 
consider a dense grid on the simplex Q{X), and construct a secure rate-distortion code, as in Lemma |9j for each 
of the types in the grid. Since the of number of types in the grid is finite, then uniform convergence is assured 
for types in the grid. If the type of the source block belongs to the grid, then one of the constructed codes is 
used, according to its type. Otherwise, the source block will be first modified, such that the modified source block 
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does have type within the grid, which is not very far from the type of the original source block. The modified 
source block will then be encoded using one of the codes of the grid, and thus will have both low legitimate 
excess-distortion probability, and large exiguous-distortion probability for the eavesdropper. It will be shown that 
the overheads required for the legitimate decoder to reproduce the original source block, rather than the modified 
source block are negligible. 

In Subsection IVI-Dl we prove the converse part in two steps. Recall that in general, for any given type Qx S 
V{X), we have defined the average rate R{S, Qx), but we allow each source block x G Tn{Qx) to have a different 
key rate r„(x) G [0, log^lT”!]. In addition, for a code satisfying the compression constraint (Rl,Dl,El), and type 
Qx such that D{Qx\\Px) < El, the legitimate excess-distortion probability must decay to zero exponentially as 
2 -n[EL-r>(Qx||f’x)] (jQgg need to be strictly zero. In the first step of the proof of the converse, we prove 
a lemma that shows that the optimal limit superior exiguous-distortion exponent is not deteriorated, if we restrict 
rn(x) to be a constant within Tn{Qx), which is less than R{S,Qx) + <5, and also restrict the legitimate excess- 
distortion probability to be exactly zero. It will be easier to prove a converse for codes with such properties, as 
will be done in the second step of the proof. In the second step, we assume the structure of the code from the first 
step, and evaluate the performance of an eavesdropper which adopts one of the following two simple strategies: 
(1) It can guess the secret key bits, and then decode using these bits just like the legitimate decoder. (2) It can 
ignore the cryptogram altogether and choose an estimate z G based on only Qx- Clearly, in the first case, the 
probability of success is 2“”^, and it is not difficult to show that the exiguous-distortion probability for the second 
strategy is asymptotically This implies the upper bound (fT^ . We remark that the asymptotic optimality 

of these two simple strategies (sometimes called key-attack and blind guessing, respectively) can also be found to 
some extent in related problems |[T4]| . 11211 . Il22l . 

We conclude the outline of the proof with the following comments: 

• Awareness of key-length: Since the number of possible key-lengths is nloglT”!, it can be compressed and 
fully encrypted using negligible coding rate and key rate of ^ log(nlog|T’|) bits, and it can be assumed 
that the exiguous-distortion exponent is not deteriorated if the eavesdropper is aware of the key-length (as 
in Subsection IVI-Ab . Thus, in the converse proof, we could have found the exiguous-distortion exponent 
conditioned on both the type and the key-length, and then average over them. The main obstacle in this 
approach is proving the second property (full type covering) assured in Lemma [13] To show this property 
using the methods of Lemma [TS] would require showing that the subsets of the type classes of fixed key- 
length, i.e., TniQxj'iTT') — Tn{Qx) H {x : kn{x) = m) for some 0 < m < nloglAl, can cover a type class 
by essentially a minimal number of permutations, as in Lemma |4| (Subsection IVI-BI ). However, in turn, the 
proof of Lemma m is based on the fact that %i{Qx) is invariant to permutations, which may not hold for 
fn{Qx,m). 

• Full type covering: Let Qx S 'P{X) be given such that D{Qx\\Px) < El. The method of types and the 
expression ([T3]) reveal that to satisfy the compression constraint (Rl, Dl, El), the following condition should 
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hold for any given 

PK(X,99„(/„(X,u),u)) > DJX € TniQx)] = 2-[El-^5(Qx||Px)]_ (26) 

For ordinary rate-distortion codes, it is well knowrQ that if for a given e G (0,1) and for all n sufficiently 
large 

P[dL(X,W) > DJ < 1-e (27) 

then there exists a rate-distortion code with almost the same rate, such that 

PK(X,W) > DJ = 0. (28) 

Thus, to ensure an exponent constraint El for ordinary rate-distortion codehook, the type classes of types 
which are ‘close’ enough to Px (in the divergence sense) should he almost covered hy the reproduction set 
(l26l ). hut in fact, can he fully covered hy the reproduction set (|28] ). Then, the minimal rate required to satisfy 
(|2^ is the same as the minimal rate to satisfy (|2^ . and the compression rate cannot he decreased due to the 
softer requirement in (l26l ). By contrast, in the presence of the eavesdropper, it might happen that the softer 
requirement in (l26l ) can lead to better exiguous-distortion exponent: Even if a type class can he fully covered 
using the available coding rate, perhaps the exiguous-distortion exponent can be improved if some of the 
source blocks are reproduced with distortion larger than Dl, but this occurs with sufficiently small probability, 
as in (|2^ . Lemma [T3] shows that this is not the case. 

• Compression constraint conditions: The conditions required to satisfy the coding rate constraint Q, and the 
excess-distortion exponent constraint for the legitimate decoder dUl can be weakened without affecting Theorem 
[2 First, © can be weakened to 

limsup — 77(y) < Rl, (29) 

n^oo 

where H(Y) is the entropy of the cryptogram. Second, the excess-distortion exponent can be weakened to 
apply to the expectation constraint over the key-bits rather than for every given i.e. 

liminf--P[dL(X,(^„(/„(X,U),U)) > DJ > El. (30) 

n—)-oo Tl 

Obviously, since the achievability part is proved using the stronger conditions © and ©, it also holds under 
the weaker conditions (l29l) and (l30l) . For the converse, note that in Lemma [13] and in the proof of the converse, 
the coding rate is essentially not constrained. The excess-distortion exponent constraint is used in the converse 
proof only in eq. (1255b . which follows directly from the weaker condition (l30b . Therefore, the achievability 
part holds under the strong conditions, and the converse part holds under the weak conditions. 

• Legitimate excess-distortion exponent: As is evident from Theorem [TJ there is no improvement in the exiguous- 


^This can also be easily verified using Lemma |4| 
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distortion exponent even if El vanishes (to wit, the distortion Dl is achieved only on the average). Thus, the 
excess-distortion exponent can he set to its maximal value of Ei^{Px-, Dl, Rl), as defined in (fTSl) . 

• Dependency on the source distribution: From the proof of the achievahility, it is evident that given Qx, the 
operation of the encoder, the legitimate decoder and the eavesdropper decoder depend on Px only on whether 
Rl > Rl{Qx, Dl) or not (equivalently, from the previous comment, whether D{Qx\\Px) < El or not). Since 
it can he assumed that Qx is known to all parties, then prior knowledge of the source distribution Px is 
not required to either party. Hence, the secure rate-distortion codes constructed are universal. Of course, the 
exponents achieved depend on Px- 


VI. Proof OF THE Theorem [H 

We remind the reader the reverse Markov inequality ESi Section 9.3, p. 159], which is a useful tool for the 
proof. 

Lemma 2. Let X be a positive random variable which satisfies P(X < aE[X]) = 1 for some a > 1 
any < 1, 

P{X > ,5E[X]) > 

a — p 

The proof is based on the ordinary Markov inequality for the positive random variable X = aE[X] 

A. Type Awareness of the Eavesdropper 

Consider the following simple observation, which simplifies later derivations: The largest achievable exiguous- 
distortion exponent is not deteriorated if the eavesdropper is aware of the type of the source block, in addition to 
the cryptogram. 

Proposition 3. For any Qx ^V{X) 

^^-(5,Dh,Qx) = liminf max logP [4(X, Z) < Dh|X € rn(Qx)]| • (32) 

n-^oo ( n<L„GE„ J 

An analogous result holds for (S, De, Qx)- 
Proof: Since Sn C Sn 

5-(5,Db,Qx) > liminf (--log max P[dB(X,Z) < De|X € Tn{Qx)^ ■ (33) 

n-)-oo ( n c.„es„ J 

To show equality, let {d* G Sn} be the sequence of decoders which achieve the maximum in the right hand side 
of (l3^ . Let us define a sequence of decoders {(T„ G as follows. First, an produces a random guess Q £Vn 
of the type of the source, with the uniform distribution over Vn, and second, it decodes 


. Then, for 

(31) 

-X. 


crn{y) = dl{y,Q). 


( 34 ) 
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Given Qx G V, the resulting conditional exiguous-distortion probability is given by 


P[dH(X,^7„(y)) < De|X G TniQx)] 

> P [d^{X,al(Y,Q)) < DhIQ = gx,X g TniQx) 
= P [dH(X, a:{Y, Q^)) < De|X g TniQx)^ ^ 

and as |Pn|< {n + equality is achieved in (l3^ . 


\Vn 


Q = Qx|X G TniQx) 


(35) 

(36) 

(37) 


B. Covering a Type Class via Permutations 

In this subsection, we discuss the possibility to cover a type class by means of permutations of a constituent 
subset. The fact that the distortion measure of the eavesdropper is invariant to permutations of both arguments hints 
on the usefulness of such a covering in the construction of good secure rate-distortion codes. 

Given a type Qx G T’(T’) and <5 > 0, the method of types implies that for re > no(5, |<T|) 


2 n[H{Qx)-S\ < |7;(Q^)|< 


(38) 


Now, consider the subset Vn C TniQx), where the elements of Vn are distinct. We say that a set of permutations 
{iTnAt^o cover TniQx) if 

U TTnA'^n) = TniQx), (39) 


t=0 


where TTn,tiTn) means that the same permutation Xn^ti') operates on all x G Vn, as defined in (l22l) . Let be the 
minimal number of permutations of Vn required to cover TniQx)- By a simple counting argument, we must have 

\TniQx)\ 


<> 


Wr, 


(40) 


The following lemma guaranteed the existence of a cover which essentially achieves the lower bound. 
Lemma 4 ( |[29l Section 6, Covering Lemma 2]), For every Vn C TniQx), Qx ^VniT) 

\TniQx)\ 


<< 


Wr, 


log\TniQx)\. 


(41) 


The main application of this lemma is for a sequence of sets {Pn}^i- Let ni be the sequence of block-lengths 
such that TniiQx) is non-empty, and let Vm C TmiQx) such that 


Wni I— 2 




(42) 


Then, Lemma |4] implies that for every <5 > 0 and I > lQi6,\X\) both 

2ni[H{Qx)-S] 


<> 


2ni{R+5) 

^ 2ni[H{Qx)-R-2S] 


(43) 


( 44 ) 
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from (ITO and 


2niH{Qx) 


(45) 

(46) 


from Lemma m Thus, the cover is asymptotically efficient, and this implies that the permuted sets cannot overlap too 
much. To further explore this property, let {Trn,,t}t=o 6e the permutations constructed in Lemma |4] for hlock-length 
ni, and define the exclusive permutations sets as 

Oni,t = (^rii) !■ • (47) 

Note that TmiQx) is a disjoint union Gni,t, and for any R < R, consider the union of exclusive permutations sets 
of small cardinality, namely 

4^(R) = U (48) 

A simple aspect of the asymptotic efficiency of fhe covering is that under the uniform distribution on the type class, 
the prohahility that the source block belongs to a small exclusive permutations set is also small. 

Lemma 5. For any R < R 

P [X G 7f(R)|X € 7;(Qx)] < (49) 


Proof: Let an arbitrary ci > 0 be given. For all n sufficiently large, if TniQx) is empty then the statement of 
the lemma is satisfied by convention. Otherwise, 


_ * . nR 

p[x.«(R)|x.r„(fc)]<i^ 

27Tji/(Qx) —R+25] ^ gTlR 


(50) 

(51) 

(52) 


C. Proof of Achievability Part of Theorem [7] 

We follow the three steps outlined in Section |Vl In the first step of the proof, we focus on a single cryptogram, 
Cn{y) = {¥^n( 2 /, u) : u G {0,1}"'^}, which we generically denote by the set Cn = {w(0),... , w(2’^^ — 1)} C IV". 
We begin with some definitions and simple properties. For a given (Dl, Dg) and Qx G Vn{Al), let X be uniformly 
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distributed over 'Zi(Cn, Qx, Dl) (defined in (|25])). The exiguous-distortion probability for the set Cn is defined a 


J 3 


Pd{Cn, Qx, Dl, De) = max 


dni^, z) ^ De 


We have fhe following simple properties for Pd{Cn,Qx, Dl, De). 

Proposition 6. Let Cn C and Qx &Vn{^) be given. Then: 

1) For every permutation vr 

Pd{Cn, Qx, Dl, De) = Prf(7r(C„), Qx, Dl, De), 


(53) 


(54) 


where x{Cn) is as defined in (I22I) . 

2) Let X be uniformly distributed over C '£)[Cn,Qx, Dl)- Then, 

maxP[dE(X,z) < De] < \^iCn, Qx,DQ\ . p^^Cn,Qx,D^,DQ. (55) 

zS-Z" \Vn\ 

Proof: 

1) Lef z* be fhe maximizer of (l5^ . Since di^{-x, w) = (iL(7r(x), 7r(w)) fhen T)(7r(C„), Qx, Dl) = vr (S(C„, Qx, Dl))- 
Since also d^{-x, 2 ,) = (iE(vr(x), 7r(z)) fhen 


Pd [vr(Cn),Qx, Dl, De] = maxP dE(7r(X),z) < De 


> p 


dE(vr(X),7r(z*)) < Dj 


— PdiQn, Qx , Dl, De), 


and fhe reverse inequality can be obfained similarly, by considering fhe inverse permufafion vr 
2) For every z € 

{xeVn- dE(x,z) < DeI 


P[dE(X,z) < De] = 


< 


jx £ ’S){Cn,Qx, Dl) : 4(x,z) < DeI 

l^nl 

\^iCn,Qx, Dl)| jx G T)(C„,(5 jv, Dl) : dE{x,z) < Dg 


Wr, 


mCn,Qx,^Q\ 


^ I® (Cn, Qx, Dl)I (p n, ri ri \ 
— 1 ^ I * VX? Dty, Dg). 


(56) 

(57) 

(58) 


(59) 

(60) 
( 61 ) 
(62) 


The nexf lemma is fhe firsl step in fhe proof, in which we prove fhe existence of a good sef C* by a random 
selection. 

Lemma 7. Let 5 > 0 and Qx S V{X) be given, and let ni be the sequence of block-lengths such that TmiQx) 
*With a slight abuse of notation, we also use here the notation Pd{-). 
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is non-empty. There exists a sequence of sets C* = {Cf} of size |C^J= 2”'^ such that for all I sufficiently large 


and 


- log|S(C:,, Qx, D0|> H{Qx) + R - RdQx, DJ - -5, 

ni 


1 


-log max P 

ni 


(63) 


(64) 


dE(X,z) < De > min{R,i?E((3x, De)} - 5, 

for all De > Dl, where X is distributed uniformly over S(C*, Qx, Dl) ■ 

Proof: Let n be given such that Tn{Qx) is non-empty. Also, let De be given, choose any Qw € Pn(W), 
and consider an ensemble of randomly chosen sets Cn, where each member is selected independently at random, 
uniformly within a type class Tn{Qw)- By definition, for any given Cn 

maxzg^n |{x G :£){Cn,Qx,Df) : ^(xjz) < De}| 


Pd(Cn) Qx ) Dl, De) — 


(65) 


\T){Cn,Qx,D^)\ 

It should be noticed, that unlike the situation in standard random coding bounds, here the denominator of (|65] ) 
is also a random variable. Nonetheless, we will show that there exists a set Cn such that both the numerator and 
denominator of (1651) are close to their expected values. To begin, let us analyze the expected value of the size of 
the D-cover in the denominator of (|65] ). We first consider the case R < R^iQx, Dl). For a given Cn and Qxw^ 
define fhe type class enumerator 


and lef 


N{Qxw\x.) = |w G Cn ■ Qxvf = Qxw^ 


Eo^H{Qx) + R-RdQx,D^)- 


( 66 ) 


(67) 


Nofe that in the last equation the X-marginal (IF-marginal) of Q is constrained to the given type Qx (respectively, 
Qw)- For brevity, here and throughout the sequel, such constraints will be omitted. Then, 


E[|S(C„,Qx,Dl)|] =E 


I {3w G Cn : dL(x, w) < Dl} 

xe7ii(Qx) 


= E 


xe7ii(Qx) 


U {E{Qxw\^) > 1} 

^ Qxw.^Qld.L{X,W)]<D]^ 


= E 


I{iV(Q^^|x)>l} 

xG7ii(Qx) Qxw'-^q [dL(X,W)]<DL 

= E E p{iv(Qwix)>i} 

x€7^(Qx) Qxw'^Q[di^{X.,W)]<D]^ 

= E E r{N{Qxw\^)>l} 

xer„(Qx)Qxw:Eq[dL(X,tt/)]<DL,/Q(JV;W)>R 


( 68 ) 

(69) 

(70) 

(71) 

(72) 
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(b) 


x&Tr,{Qx)QxW-KQ[di^{X,W)]<DL,lQ{X-,W)>R 


^ 2nHQ{X) 

Qxw^Vr.(X^Wy.¥.Q[di,{X,W)]<Di„lQ{X-,W)>R 


(c) 

= exp < n ■ 
= 2”'®“ 


Hq(X) + R - min IniX] W) 

Qxw&V„{XxW):KQ[di,{X,W)]<DL 


(73) 

(74) 

(75) 

(76) 


where in (a) and (c) we have used the assumption R < Rl{Qx, Dl), and so, the set {Qxw ■ Eg [4(36, (4^)] < 
D^,Iq{X;W) < R} is empty. In (b), we have used the fact that N[Qxw\^) is a binomial random variable 
pertaining to 2”^ trials and probability of success of exponential order exp [—n/Q(X; VK)]. Passage (d) follows 
from the fact that V{X x W) is dense in Q{X x W) and Iq{X; W) is continuous. In addition, using the union 
bound, with probability 1, 


|3(Cn,Qx, Dl)| < ^ |{x G 7;i(Qj\:) : 4(x, w) < Dl}| 

WSCn 


< 2”^•exp 


_ 


n- max Hq(X\W) 

Qxw&Vn{XxW):KQ[di,{X,W)]<DL 


(77) 

(78) 

(79) 


Next, we upper bound the numerator of (1651) . For a given Cn and z G Z^, define now the type class enumerator 


R^iQzwl'^) — |w G Cn ■ Qzw = Qzw^ 


(80) 


Then, 


|{x G Z){Cn,Qx, Dl) : 4(x,z) < De}| 


(81) 


= [J {x G 7;i((5x) : 4(x,z) < DE,dL(x, w) < Dl} 

wSC„ 

= U U U {x G 7;(Qx|zty,z,w)} 

Qzw 'w£Tn{Qw\z■,z)nCn Qx\zw'^Q[dE{X^Z)]<D^^¥.Q[di^{X^W)]<D]^ 

< XI XI X |{x G 7 ;(Qjv|zh^,z,w)} 

Qzw w€7ii(Qw|z,z)nC„ Qx\zw'-^q l<iE{X,Z)]<DEfiQ [dL(.Y,tV)]<DL 



E 


E 


2nHQiX\ZW) 


Qzw wG77(Qw|z,z)nC„ Qx|zw:IEQ[rfE(-^,.^)]<DE,EQ[rfL(^,tl^)]<DL 


= E E 

Qzw wG77(Qw|z,z)nC„ 


max 

Qx|ziv:EQ[dE(X,Z)]<DE,EQ[dL(X,ty)]<DL 


2nHQiX\ZW) 


= 'Y R^iQzwl'^) laiax 

Qxizw.KQ[dE{X,Z)]<DE,KQ[dE{X,W)]<Di, 

Qzw 

= max max 

Qzw Qx|zw:EQ[dE(X,Z)]<DE,EQ[dL(X,M/)]<DL 


(82) 

(83) 

(84) 

(85) 

( 86 ) 

(87) 

( 88 ) 
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Qx zxv :IE<3 [ciE (^, •^)] < De ,E<3 [dL (X, W)] < Dl 

where (a) is the union hound, and in all the above equations, Qxzw ^VniX x Z x W). Let 


(89) 


^(Dl, De) = {Qxzw G Vn{X X Z X W) : Eg [d^{X, Z)] < De, Eq [4(X, VL)] < De} . 


(90) 


Taking expectation, and using the fact that \Vn{X x Z x W)|< (n + l)l'^ll-^ll^l i.e., increases with n only 
polynomially. 


E 


< E 


= E 


max |{x G 'Zi{Cn-,Qx-, Dl) : 4(x,z) < De}| 


max 


y~l ^(Qziy|z)2' 


.nHQ{X\ZW) 


QxzwGt7(DL,DE) 


lim < 

/9—>oo 


lim E 

/3 —>00 


= lim E 

/3 —>-00 


= lim E 

/3 —>-00 


= lim E 

/3 —>-00 


iV(Qzw^|z)2”^o(^l^^) 

\Qxzw€J’{Dl,De) 


5] iV(Qzu/|z)2-^«(^l^^) 

z€2" \ Qxziv€J7(Dl,De) 


VT 


VT 


y max iV(Q^^,^|z)2-^«(^l^^) 

izg^" VQ^2wGt7(DL,DE) 

(y max 

\^^^„QxzwGJ(Dl,De) J 


I zg2” QxzwGJ7'(Dl,De) 






V/3' 


< lim I y y E N{Qzw\y 

/3—>cx) \ 

zg2" QxzwGJ7’(Dl,De) 




= lim ( y y 

/3—j-oo \ 2—/ / 

^ze^" QxzwGj^{DL,DE):/Q(Z;iy)<R 


E 


JV(«z»-N)d 


+ E E 

z£Z'^ QxzwG,7{DL,DE):/Q(Z;ty)>R 


N{Qzw\z)f^] 




2 lim (y 


jS^oo Y 


E 


2nl3[R-lQ(Z-,W)]2nPHQ{X\ZW) 


zGZ" 


Qxzw&J {Oi^,De)-.Q z=Qi,Iq{Z-,W)<R 


+ E E 

QxzwGJ^{Dl,De):Qz=0.,/q(Z;M/)>R 


2^[R—/q 


{Z-,W)]2nPHQ{X\ZW)\ 




(91) 

(92) 

(93) 

(94) 

(95) 

(96) 

(97) 

(98) 


(99) 


( 100 ) 
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= lim (V V 

(3^00 

^ Qz Qxwiz-KQ[dE{X,Z)]<DE,KQ[di^{X,W)]<DL,lQ{Z-,W)<R 


2nl3[R-lQ{Z-,W)]2n/3HQ{X\ZW) 


Qz Qxw|z:IEQ[rfE(X,Z)]<DE,EQ[dL(X,VK)]<DL,/Q(Z;VK)>R 

= lim max 

/3^oo VQxzwS J'(Dl,De):/q(Z;H/)<R 

+ Qxzw6^(DED^K«(Z;Ty)>R^ 


nfR-7, 


V3 


q(Z;W)]2n/3//Q(X|ZM^)j 


V/9 


( 102 ) 


= lim maxi max 

/3—>-00 V IQxzw6J^(Dl,De);/q(Z;M/)<R 

. > V/3 

max 

Qxzw6^(DJS:/q(Z;Vy)>R^ 

= lim max| max 

/3—>-00 tQxzw6j^(DL,DE);/Q(Z;W^)<R 

QxzweJ(DL,DE);/Q(Z;W)>R / 

= max| max 

tQxzweJ(DL,DE):/Q(Z;W)<R 

max 

QxzwGJ'(Dl,De):/q(Z;H/)>R J 


(103) 


(104) 


(105) 


where (a) is by the Lebesgue monotone convergence theorem ll^ Theorem 11.28] and the monotonicity of the 
argument inside the expectation operator in /3, and (6) is by the Jensen inequality. In (c), we have used the analysis 
in ll^ Subsection 6.3] of the moments of N{Qzw\'^)^ which is a binomial random variable with 2"^^ trials and 
probability of success of the exponential order of exp [—n/Q(Z; VK)]. Also, note that in all the above equations, 
Qxzw Q 'Pni^ X Z X W) but since ■p(A x Z x W) is dense in Q{X x Z x W) and the arguments of the 
maximization are continuous functions of Qxzw^ we can change the maximization to be over Q{X x Z x W). 
Thus, 


E 


max |{x G S)(C„, Qjv, Dl) : 4(x,z) < De}| 

zGZ" 


^ 2’^^i(De) 


(106) 


where 


^i(De)= max {Hq{X\ZW) + [R-Iq{Z-W)V] . (107) 

Qxzw:EQ[dE(X,Z)]<DE,EQ[dL(X,ty)]<DL '' v +J 


Now, let 5 > 0 be given. There exists no(Qx) such that for all n > no(Qx)^ we have from (1761) 


E(|2)(C„,Qx,DE)|)>2-(®“-f), 


(108) 


and from (1791 ) 


|2)(C„,gx,DE)|<2-(^'>+f). 


( 109 ) 
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Define, for the given ensemble of the random sets 

A = {Cn : |S(C„,Qx,DJ|>2-"fE[|S(C„,Qx,DJ|]}. (110) 

The reverse Markov lemma (Lemma ^ implies 

1 _ 

IP (Aq) > — -^ > 2-2”^ (111) 

2nS _ 2-^2 

where the second inequality is satisfied for all n > Uq for some Uq > no{Qx)- 

Now, note that we need to prove that a single set C* satisfies (l64l) for all Dg > Dl- To show this, we consider a 
quantization of the possible values of D.. To this end, let an arhittatr , > 0 he given, such that J is 

integer, and find Dg sufficiently large such thau 


Re{Qx,De)< lim Re{Qx,De)+7]. (112) 

De—>- c>o 

Let us quantize the interval [iiE(Qx) De)) Dl)] to values {R(0),... , R( J)}, where R(j) = jrj and let 

DE(j) = Re^{Qx,^U))’ where is the inverse function of i?E(t5x,DE). By (11051) . there exists 

niiJ, Qx) such that for all n > ni(j, Qx) 


E 


max ||x G T)(C„ 


Qx, Dl) : dE(x,z) < DE(j)}| 


< 2 


n[i?i(DE(i))+<5] 


where the expectation is over the random ensemble of sets By defining 


(113) 


Aij = [cn ■■ max |{x G 'S){Cn,Qx, Dl) : dE(x,z) < DE(j)}| < 2”'[^i(°E(i))+4<5] 


the ordinary Markov lemma implies 


'(^i,)>l- 


E[maxzg 2 n |{x G D(C„,Qx,Dl) :dE(x,z) < DE(j)}|] 


2n[£;i(DE(i))+4(S] 


> 1-2 


—3nS 


(114) 


(115) 

(116) 


Defining Ai = n/=o Aij we get 


E(v4i) =P 



= 1 -P 



>l-^P(yiy 

j=o 

> 1 - J • 


(117) 

(118) 

(119) 

( 120 ) 


®Note that if dE{x, z) < oo for all x ^ X, z £ Z, then limoE-foo Re{Qx, De) = 0. 
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Thus, since J does not depend on n, there exists n'l > maxo<j<j ni(j, Qx) such that for all n > n[ 


P(An^i) = 

> 1 -P(^;5) -P(^5) 

> 1 - (1 - 2 


-2n5^ _ j2-n^ 


_ 2~2n5 _ j ^ 


> 0 . 


( 121 ) 

( 122 ) 

(123) 

(124) 

(125) 


Therefore, for all sufficiently large n > max{nQ, n'^}, there exists Cn € Aq H which satisfies 


hofh 


|S(C„, Qx, DJ|> 2-’^^E[|S(C„, Qx, 


(126) 


and 


max |{x G S(C„,Qx, D,) : 4(x,z) < DH(i)}| < 
zeZ" 


(127) 


for all 0 < j < J. Thus we get 

<r\nEi ( De {j )) 

Pd [Cn, Qx, D„ D,(i)] <- , = 2^-^ • 2-[®4 De(.))-Eo]. 

If we now define £'(De) = -Ei(De) — Eg, then for any given Qw G 'Pn(W’) 


(128) 


liminf -- logp^ [Cn, Qx, Dl, De(j)] > E{De). 

n^oo Tl 


(129) 


Now, choose let Qw be the VP-marginal of Qxw which achieves Rl{Qx, Dl)- Then, 


E{DQ> min {Iq{Z-,W) + Iq{X-Z,W)} 

Qxzw.^Q[dE{X,Z)]<DE,^Q[dL{X,W)]EQ[di^{X,W)]<Di^,lQ{Z-,W)<R 

min Iq{X-W) 

QxwMQ[dE{X,W)]<DE 

> min {Iq{Z-W) + Iq{X-Z,W)-Iq{X-W)} 

Qxzw-¥.Q[dE[X,Z)]<DE,'^Q[dE{X,W)]<DE,lQ{.Z\W)<R 

min {Iq{Z-W) + Iq{X-Z\W)} 

Qxzw.^Q[dE(X,Z)]<DE,^Q[dE{X,W)]<OE,lQ{Z-,W)<R 

min Iq{X,W-,Z) 

Qxzw.^Q[dE{X,Z)]<DE,^Q[dE{X,W)]<DE,lQ{Z-,W)<R 

> min Iq(X]Z) 

Q X zw-KQ[dE{X ,Z)]<De 


— Re{Qx , De) 


(130) 

(131) 

(132) 

(133) 

(134) 

(135) 


where (a) is hy restricting Qxw to he the same in both minimizations of (11301 ). and (6) is hy the data processing 
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property of the mutual information. Similarly, 


E{D^)>R+ min Iq{X;Z,W) 

Qxzw.^Q[dE{X,Z)]<DE,^QldL{X,W)]<Di^,lQ{Z-,W)>R 

min Iq{X-W) 

Qxw.KQ[dE{X,W)]<OL 


(136) 


>R+ min Iq{X]Z\W) (137) 

Qxzw.^Q[dE(X,Z)]<DE,^Q[dE(X,W)]<DE,lQ{.Z-,W)>R 


> R. 


(138) 


by restricting Qxw to be the same in both minimizations of (I1361) . 

Therefore, (11291 ). (11351) and (11361) imply that 

liminf--logprf [Cn,Qx, Dl, DE(i)] > min {it!E((5x, DE(j)), R} (139) 

n^oo Tl 

for all 0 < j < J. By taking r/1 0, continuity of Re{Qx, De) in De provides the lower bound (l6^ for all De > Dl- 
Then, (l6^ is obtained from (11261) and (11081) . 

To complete the proof of the lemma, we consider the case of R > Ri^{Qx, Dl)- Denote by Q^w ^ sequence of 
distributions such that (5xty Qxw as re ^ oo, where Q*xw achieves the rate-distortion function Rl{Qx, Dl). 
For a given Cn, let be a subset formed by the first members of Cn- The same analysis as before 

shows that when randomly drawing a set Cn uniformly over the FF-marginal of Qxw’ exists a sequence of 
sets {Cn} such that 

|S(4,Qx,Dl)|> (140) 


Then, for (3„ 


Pd(finj Qx ) Dl, De) — 
< 

< 

< 


maxzs^n |{x e D{Cn,Qx,DL) ■ 4(x,z) < De}| 

\^iCn,Qx,DE)\ 

maxzg^r. |{x € D{Cn,Qx,^L) ■ rfE(x,z) < De}| 
\^{Cn,Qx, De)\ 

maxzg^r. |{x e TnjQx) ■■ 4(x,z) < De}| 
\^{Cn,Qx,DE)\ 

maxzg^^ |{x € TnjQx) ■ rfE(x,z) < De}| 
2n[H(Qx)-S] 

\'Tn{Qx\Z,'^) 

Qx\z'-E,Q[dE{X,Z)]<DE 

2nHXX\Z) 


= max 

zg2" 


<2-[^(Q-)-^]max 

Qz 


Qx\z-^QldE(X,Z}]<DE 


= exp re 
^ 2 “^[^e(Qx,De)—5] 


Hq{X)-5- max Hq{X\Z) 

Qxz.^Q[dE{.X,Z)]<DE ^ 


(141) 

(142) 

(143) 

(144) 

(145) 

(146) 

(147) 

(148) 


and the proof of the lemma is complete, as 5 is arbitrary. 
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Remark 8. As mentioned in Section |Vl to show achievability of an exiguous-distortion exponent using the method 
of types, uniform convergence of —^ logprf(C*, Qx, Dl, De) to the exponent min{R, R^{Qx, De)} is required (cf. 
eq. (I2331) '). However, the proof of Lemma |7] is not sufficient to show this. Specifically, fhe convergence in fhe 
asympfotic analysis of fhe type class enumerators, i.e. the relations 

P{^(Qxw|x) > 1} = (149) 


used in (17^ and 


E 


N{Qzw\'^)^ 


/ 

2n[K-iQ{z-,w)]^ /q(Z;VL)<R 
2n/3[R-/Q(Z;ty)]^ Iq(Z;1L)>R 


(150) 


used in (11001) . are not uniform in Qx- 

We continue with the second step of the proof, which constructs from the set C* a secure rate-distortion code 
for all X G Tn{Qx)- The proof of the next lemma is based on the permutations technique described in Subsection 

wm 


Lemma 9. For any given Qx G T’(<T’) n int Q{X) and <5 > 0, there exists a sequence of secure rate-distortion 
codes S* of fixed key rate R such that 


lim - log|3^„l< Rl{Qx, Dl) + S, 

n^cx> fi 


(151) 


and, 


> DJX G TniQx)] = 0 


(152) 


for every u G {0,1}”^, as well as 


£f{S*,D^,Qx)>mm{R,R^{Qx,DQ}-d 


(153) 


for all De > Dl. 

Proof: Assume that Qx G [int Q{X)] FVno{^) some minimal no G N. Since the statements in the lemma 
are only about conditional events given the type Qx, it is clear that the secure rate-distortion codes constructed 
<S*, may only encode x G Tn{Qx), and so only block-lengths n mod no = 0 should be considered, as otherwise 
TniQx) is empty. 

Let C* = {C*} be a sequence of sets of size 2”^ constructed according to Lemma |7] So for all n sufficiently 
large 

PdK,Qx, Dl, De) < 2 —(^ 54 ) 


and 


|S)(c;:,Qx,Dl)| 


( 155 ) 
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where 

A ^ min {H(Qx) + R - Ji^Qx, D,),II(Qx)} ■ (156) 

Now, let {Trn^t}t=o ^ permutations constructed according to Lemma HI such that 

U 7r„,t(S(C:, Qx, DJ) = TniQx), (157) 

t=0 

where Hn < and let {Gn,t} be the resulting exclusive permutation sets, as defined in (|47] ). 

We construct the following secure rate-distortion codes S* = (/*,(^*) of fixed key rate R, which only encode 
X G TniQx)- We utilize the covering of the type class TniQx) by permutations of a D-cover of the set C* 
to encode the source block in the following way. Assume that the elements of C* are arbitrarily ordered, i.e. 
= {w(0),... , w(2”^ - 1)}. For a given x G TniQx), let 

t* ix) = min {t : X G Qn,t} , (158) 

and 

i*ix) = min{z : w(f) G w(f)) < Dl} (159) 

The encoding is a concatenation of the following two parts y = /*(x, u) = ity,iy): 

• A description of the permutation set, defined as ty = M[t*ix)-,niHiQx) — A + 2(5)]. 

• An encrypted description of the distortion covering codeword, defined as iy = ]B[z*(x);nR] © u. 

It is easily verified that given u, the legitimate decoder can reproduce w = (fniu, u) such that Tix,^) < Dl, for 
all X G TniQx), and so (11521 ) is satisfied. Regarding fhe coding rate, note that 

-log|3^„| = 77 (Qx)-A + 2(5 + R (160) 

n 

<7?l(Qx,Dl) + 3,5 (161) 

for all n sufficiently large, which results in (11511) . 

It remains to prove that for any eavesdropper (T„, the conditional exiguous-distortion exponent, given that X G 
TniQx), is larger than min {R,Dg)} — 5. From Proposition |3l it may be assumed that the eavesdropper is 
aware of the type Qx- Moreover, given the cryptogram Y = y, the source block X is distributed uniformly over 
Gn,ty, and independent of iy. Thus, the optimal eavesdropper has the same estimate for cryptograms with the same 
ty, and we may denote its estimate as z = aniy) — z(fy). Since Gn,o = ^iCn,Qx, Dl), then conditioned on the 
event {f*(X) = 0}, for any z G Z^, Lemma |7] implies 

P[4(X,z) < Dh|X G TniQx), t*iX) = 0] = P[4(X,z) < Dl|X G gn,o] 

^ 2“”-[™™{R>^e(<3x,De)}-(5] 


(162) 

(163) 
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for all n sufficiently large. It then follows that for 0 < t < Kn, 


P[4(X,z) < Dh|X G rn(Qx),f*(X) = f] =P[dB(X,z) < Db|X G Gn,t] 

IGnol 

< i^P[4(X,z) < De|Xg6;„,o] 

- |^n,o| D— n(min{R,i?E(Qx,DE)}—I?) 

“ \Gn,t\ 


(164) 


where (a) follows from the fact that for any 0 < f < /c„, there exists a permutation vr such that tt {Gn,t) C Qn,o = 
S(C*, Qx, Dl) and Proposition!^ Thus, the exiguous-distortion prohahility conditioned on f*(X) = t can he larger 
than the same prohahility conditioned on t*(X) = 0, hut only up to a factor of which is large if |^n,t| 

is small. Next, we show that the contribution to the exiguous-distortion prohahility of these small sets does not 
impact its exponential behavior. To this end, for any fixed 0 < r] < A + 5 such that J = is an integer, let 
us quantize the interval [0, A + 5] to values {Aq, ..., Aj}, where Aj = jrj. We will treat separately sets such that 
2'^^3 < For all n sufficiently large 

P [dE(X, z) < De|X g TniQx)] (165) 

= J]P[XGen,t|XGrn(Qx)]P[4(X,z(t)) < DE|XGe„,t,XGrn(Qx)] (166) 

t=0 


, 7-1 



E 

P[XGan,i| 

TniQx)] '- 

P[4(x, 

2=0 t:2" 


^j+i 



sE 

E 

P [X G gn,t 

:|X G TniQx)] 

|^n,o| D 
\Gn il 

2=0 t:2’ 

'‘N<ie„,q<2’ 

■‘N+i 



J-1 

E 



2n{A+S) 

VI 

P[XGan,i 

|X G TniQx)] 



2-n(min{R,i7E(Qx,DE)}-5) 


J=0 j|<2'*N+i 

‘yn{A+S) 

Y, ^^2-"(“”1^’^e(Qx,De)}- 5) ^ p [X G ^„,t|X G TniQx)] 

t:2'*N<|g„,t|<2"N+i 


2=0 

(b) 2^^+^) 


^ ^^2-"(““1''’^e(Qx,De)}-<5)p[x e 'HiA,+i)\X G TniQx)] 


3=0 


('c') nn{A+5) 

< _ _2“”(™™{f^>'^E(<9x,DE)}-<5)2-’^(7l-A3+i-<5) 

— 

3=0 

nn(Aj^i-\-2S) 

<j. max - -^-2-^(™“l^’'f^E(Qx,DE)}-5) 

^ 2’^(^+35)2“’^'™™{Ri^e(<3x,De)} 


(167) 

(168) 

(169) 

(170) 

(171) 

(172) 

(173) 

(174) 

(175) 


where (o) is using (11641) . (5) is using the definition in (|48]) . (c) is using Lemma [51 and (d) is since J = 1. The 
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result follows by taking r/ 4 , 0. 


Remark 10. Note that only the properties (I154b - (I155I ) of S(C*,(5x, Dl) were used in order to prove Lemma 0 
The same proof of Lemma |9] can be used to show that if some other set Vn C '£){€*, Qx, Dl) satisfies similar 
properties, i.e. if for some E > 0 


max 




< 2 


—nE 


(176) 


where here X is distributed uniformly over and 


\Vn\ > 


(177) 


then a secure rate-distortion code can be constructed, with conditional exiguous-distortion exponent E. In this case, 
the code is constructed such that only source blocks in Vn are mapped to the permutation index f*(x) = 0, but not 
source blocks from V{C*,Qx, Dl)\ 77„. In addition, if the coding rate is unconstrained, then the condition (11771) 
is not required. This fact will be utilized in the sequel in the proof of Lemma [13] 

In the third step of the achievability proof, we construct the secure rate-distortion code for all types in V{X). 
We will need the following two lemmas. 

Lemma 11. Let QxiQ'x ^ and assume \\Qx — Q'x\\~ d* > 0- ^ ^ %iiQx) then 

min dY^{yL,-x!) < d*. (178) 

x'GT^Qk) 

Proof: See the extended version of li27l Lemma 20]. ■ 

Lemma 12. Let Qx S Vni^) and x € Tn{Qx)- For any given 1 <k < n let x! = Then 

IIQx-Qx'IK I'^l—(179) 
n — k 


Proof: See the extended version of li27l Lemma 21]. ■ 

We are now ready for the third and final step of the proof of the achievability part of Theorem [T] 

Proof of achievability part of Theorem [7]- Let 0 < e < 1 be given, and find no sufficiently large such that for 

any (5^ G P(7f) there exists (5x ^ 'Pno{X)L\mi Q{X) such that ||(5x —<3x11— f ■ We will term Dint Q(T’) 

as the grid. Also let rii = nge -f 2no\X\. We construct the following sequence of secure rate-distortion codes S for 
all n > max{no,ni}. We will use the following definitions and constructions: 

• Let h = — ■ na¬ 
• Enumerate the types of the source Vn{X). 

• Assume, w.l.o.g., that X = {1,, \XW and let X = {0} U X. 


’°For two different types in Pn{X), the minimal variation distance is A 
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• Let 

- {x €-L"" : ^(x, 0) < yI , (180) 

i.e., an Hamming ball of radius ^ and dimension n. 

• Construct the codes Si = {fi ) of key rate R as in Lemma |9l for all Qx € Vno {^) C int Q{X). 

• For every given Qx S Vn{X) find 


T>e(Qx) = argmin ||Qx-Qxll- 

QkePno(A’)ninta(A’) 

(181) 

• For any given x £ and x £ , define the replacement operator ^ : X^ x 

X^ which for 

X = 'F(x,x) satisfies 

/ 


Xi = < 

Xi, Xi = 0 

(182) 




• For a given x £ X^, define the replacement set 



^(x,e) = |x £ B^{e) 

:4/(xf,x)£rn(4>,(Qx))}. 

(183) 


Note that the size of /C(x, e) depends on x only via its type Qx- 
The above type enumeration and the codes constructed are revealed to both the encoder and the decoder off-line. 
Before we provide the details of the encoding and the legitimate decoding, we outline the main ideas. Using the 
construction of Lemma |9j we construct secure rate distortion codes for each type in the grid Vnoi^) C int Q(^}- 
Since this grid has a finite number of types, then for all sufficiently large n, the normalized logarithm of the 
conditional exiguous-distortion probability is close to the exponent (11531) uniformly over all types in the grid. As 
mentioned in the outline of the proof in Section |IVl we will modify any given source block so that it can be 
encoded using one of the codes in the grid. In order to allow the legitimate decoder to be able to reproduce with 
the desired distortion Dl, the cryptogram will be comprised of (at most) four parts, each one of them being encrypted 
using key bits for 1 < i < 4. First, the type of the source Qx is conveyed to the legitimate decoder, and, in 
accordance with Proposition |3 the type information is not encrypted, and so is the empty string. This type 
will be modified to the type 4>£((5x)^ which is also known to the legitimate decoder and the eavesdropper. Second, 
since if n mod no 0 then Qx may not belong to the grid, we first truncate the source block to the length n. The 
truncated part x^^^ will be sent to the legitimate decoder losslessly, and fully encrypted using Third, we will 
modify x” to the modified vector v, such that Qv = ^e(Qx)- This will be done by replacing a small number of the 
symbols of x. The symbols of x which were replaced in order to create v will he sent to the legitimate decoder 
losslessly, and fully encrypted using Note, that there might be more than one way to replace the symbols of 
X, and in fact, any x S /C(x, e) can be used for this purpose if we define v = 'I'(x",x) using (11821) and (11831) . 
For the sake of the analysis, it will be convenient to choose a replacement vector randomly from /C(x, e). This 
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will be achieved using key bits u, which in this case, function as common randomness rather than for encryption. 
Fourth, the code s! - will be used to encode the modified vector v using the key bits As we will prove, 
the whole modification procedure incurs a negligible cost on the compression and secrecy performance, which we 
analyze after formally defining the encoder and legitimate decoder. 

Encoding: Let u = u). The following cryptogram parts are generated: 

• Source block type: Find the type index 0 < j* < |P„(A’)| —1 of the source block type in the enumeration of 
the types, and let 

yi^]B[r;log|iP„(A)|]. (184) 

Set = (j), namely, the type information is not encrypted, in accordance with Proposition [3l 

• Fully encrypted source block tail: 

y 2 = (n - n) loglAl] © (185) 


Modification vector: Let x be the vector in /C(x, e), where u is of length log|/C(x, e)| bits, and is 

integer corresponding to u, i.e. 

log|/C(x,e)| 

(186) 


log|/C(x,e)| 

Kt,= Y. + 

i=i 


Also, let 


v4^(xf,x) 


(187) 


and let x"' G where 

/ 

0, Xj = 0 

/// ’ * 

Xj = < 

7“ 0 

\ 

As clearly x'" G let i* be the index of x'" in B'^{e) and 


y3 = B[r;log|^S(e)|]©u(3). 


(188) 


(189) 


• Cryptogram of modified vector: Let 




n,^e{Qx) 


(v,u 


(4)' 


(190) 


where is of length reR bits. 

The encoding of the source block is separated into two cases, depending on its type Qx- If Rl < 7?l(Qx) Dl) then 


Otherwise, if Rl > 7?l(0x, Dl) then 


y = /n(x,u) = yi. 


(191) 


y = u) = {yi,y 2 , y3,y4)- 


(192) 
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To verify that such coding is possible, notice that from Lemma [12] and the fact that n > ni, we have 

||Qxf-Qx||<| (193) 

and hy the triangle inequality 

IIQxf “ Qv||< IIQx” “ Qxll + IIQx — <0v||< 2 2 ~ (194) 

Thus, the definition (11801) . and Lemma [TT] imply that /C(x, e) is indeed non-empty, and an appropriate x can always 
he found. 

Decoding by the legitimate decoder: Upon observing y = /*(x, u): 

• Recover the type Qx from yi, and determine ‘he(Ox) and |/C(x, e)|. 

• If Rl < Rl{Q:x., Dl) then arbitrarily choose a vector from w G and reproduce 

w = <^*(y,u) = w. (195) 

Otherwise, if Rl > Rl{Qx, Dl) then: 

- Recover x^^^ from 2/2 and Let w" G be such that dL(x^+i,w") = 0. 

- Recover x"' from 2/3 and and let w'" G be such that di^{x"'= 0. 

- Reproduce v from 2/4 and as 

w"" = (y4, ) (196) 

- Reproduce the source block as 

W = ¥5n(2/,u) = (T'(w"",w'"),w")- (197) 

Note that the decoder knows |/C(x, e)| and thus can compute the total length of u. So, if multiple source blocks 
are encoded in succession, the legitimate decoder can stay synchronized with the encoder and use the correct key 
bits when deciphering the message. 

For the sequence of codes S* constructed, we need to verify that the compression constraint is satisfied, and to 
find fhe achievable exiguous-disfortion exponenf for any (type aware) eavesdropper, as well as the key rate. First, 
consider the compression constraint. For the rate, recall that the cryptogram is composed of at most four parts 
(I192I ). Let ynj be the alphabet of the j-th part, for 1 < j < 4, such that |3^„|= \[]=i\ynj\- We have, 

\yni\=\Vn{X)\<{n + l)\^\ (198) 

and 

|3^n2|= 


(199) 
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For 3 ^„ 3 , 

I3^n3|= Hie) 


ne 


- \ 

II 

(200) 

ne / n \ 

(201) 


(202) 

A 2tt9(e) 

(203) 


where g{e) was implicitly defined, and p(e) 4- 0 as e 4- 0. For notice that the cryptogram part ^4 is only used 
for types Qx which satisfy Rl > Rl{Qx, Dl). Thus, 


| 3 ^n 4 | < E 2 ’T’^l(Qx,Dl) 

QxGTTi(Qx):RL>fiL(Qx,DL) 

< \Vniy)\-2^^^ 


Therefore, for all n sufficiently large 


1 ^ ^ ^ 
lim sup — log 1I < lim sup > — log 13^, 

n—^oa U n—>-oo . U 

J = 1 

E Rl + ff(e) + 3(5. 


(204) 

(205) 


(206) 

(207) 


Now, as the codes 5? are constructed according to Lemma |9l it is easily verified that if Rl > BlIQx, Dl) then 
for any u 

c^l(x,<(/*(x,u),u)) < Dl (208) 

(see (1152b ). Thus, as \Vni^)\< {n + for all n sufficiently large 


P[dL(X,yp;(/:(X,u),u))>DL] 

(209) 

= P [X G TniQx)] P K(X, ipUf^i^, u), u)) > Dl|X G TniQx)] 

(210) 

Qx€V^{X) 


< p[XGr„(Qx)] 

(211) 

Qx€'P„(A’):RL<i?L(Qx,DL) 



(212) 

Qx&'Pn ('t^):RL<t?L(Qx ,Dl) 


^ 2“"'[®l(Gx,Dl,Rl)—5] 

(213) 


(214) 


Second, let us analyze the exiguous-distortion exponent of S for an arbitrary eavesdropper. Let v* he the eaves¬ 
dropper which maximizes the exiguous-distortion prohahility for the modified source block v, given the cryptogram 
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y. Then, 


(a) 1- . 


n-i-oo Qx&V^iX) 


1 


(iS, De) = liminf min \ D{Qx\\Px) -log max P[4(X, Z) < De|X G Tn{Qx)] 


(b) 

> liminf min < min 

n^oo QxG7’„(A'):Rl>-Rl(Qx,Dl) 


n 5-„GS„ 

D{Qx\\Px)- 


(215) 


i log (|^s(e)|P 4(V, V*) < De|v € rn{<^,{Qx)) 
n 


min J D (QxWPx) - - log max P [^(X, Z) < De|X G Tn{Qx)] 

QxGT„W:Rl<Rl(Qx,Dl) 1 n 

(c) r r 

>liminfmin< min {D(Qx\\Px) — 

n^oo QxGP„(A^):Rl>Rl(Qx,Dl) 


(216) 


ilog |^S(e)|P 4(V,V*) < De|V g TniMQx)) 
n 


min {D{Qx\\Px) + Re{Qx,D^)-S 

QxG'P„(A-):Rl<Rl(Qx,Dl) 


(217) 


min< liminf min < D (Qx\\Px) — 

[ rn-cx) QxGP„(A’):RL>iiL(Qx,DL) [ 


1 


n 


log |^S(e)|P 4(V, V*) < De|V g TniMQx)) 


liminf min < D {Qx\\Px) + Re{Qx,0e) - S 

n^oo Qx€P„(A’):Rl<-Rl(Qx,Dl) 


(218) 


where the passages are explained as follows: 

• Equality (a) is standard method of types, (as, e.g., in (I2141) l. Notice that the exiguous-distortion event 
{dE(X, Z) < De} in this equation is for the code Sn- 

• Equality (b) is verified hy establishing the following properties: 

- Property 1: Due to the permutation invariance of type classes and Hamming spheres, given the event 
X G Tn{Qx), V is distributed uniformly over Tn{^e{Qx))- Indeed, let v',v" G Tn{^e{Qx)), where 
v' = 7r(v") for some permutation vr. Then, if for some x G Tn{Qx) and x G /C(x, e) 


v' = 4/(xf,x) 


(219) 


then 

v" = 4'(vr(x^),7r(x)) (220) 

where (7r(x”), x7^^) G TniQx) and 7r(x) G /C((7r(x”), x7^^), ej**! The property then follows from the 
fact that |/C(x, e))| depends on x only via its type, which is identical for both x and (7r(x”), x^^j^). 

"Notice that /C(x) depends on x only via its first h components. 
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- Property 2: An eavesdropper for v is aware of its type (as Qv = ^e(0x)l3 and the cryptogram 2/2 is 
not relevant for its estimate. Also, since 2/3 is fully encrypted (pure random bits) then it is also useless. 
Thus, an eavesdropper for v uses only the type information in 2/1 and 2 / 4 - 

- Property 3: Consider the case Rl > Ri^{Qx,Dl)- The source block X is distributed uniformly over 
Tn{Qx) and V is distributed uniformly over Tn{^e{Qx))- Let V* be the eavesdropper which achieves 
the maximal exiguous-distortion probability for V, given 2 / 4 . Then, for any eavesdropper decoder dn which 
estimates z 


1 


-P[4(X,Z) < De|X e Tn{Qx)] < p 4(v, V*) < De|V g Td^eiQx)) 


Indeed, since X ^_|_2 is fully encrypted then it is easy to verify that 


( 221 ) 


' [d^(X, Z) < De|X G TniQx)] < P [4(Xf, Zf) < De|X G TniQx)] . 


( 222 ) 


Now, any eavesdropper Z” for X” can be transformed into an eavesdropper V for V, by a uniformly 
distributed guess of X over B^{b) (see (I187M and then setting 


V = < 


argmin^g^ ^(xi, z), Xj 7^ 0 
Zi, X,; = 0 


(223) 


where by assumption, min^g^ z) = 0. If the guess of x is correct (according to the relation (11871) ) 
then 


4(v, v) < dE(x,z). 


(224) 


Since this happens with probability larger than [|;B^(e)|] ^ , then (12221) implies (12211) . 

Equality (6) then follows from the above considerations. 

• Inequality (c) is because in case Rl < Rl{Qx, Dl) the eavesdropper has no knowledge beyond the type of 
the source block, and so given such y, x is distributed uniformly over Tn{Qx)- For any given z G Z'^, using 
standard method of types 


'[dE(X,z) < D^\K^Tn{Qx)] = 


E 


ir„{<3x)l 


xG77(Qx):rfE(x,z)<DE 

E E 

Qx\z'tKQ[d^(X,Z)]<D^ xG7),(Qx|z,z) 

1 


1 


\Tn{Qx)\ 


\Tn{Qx)\ 




Qx I z :Eq [dE{X,Z)]<DE 




(225) 

(226) 

(227) 

(228) 


’^Which is in fact not even required, using Proposition 
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Then, 


maxi 


'[dH(X,z) < De|X e Tn{Qx)] < 2-"[«e(Qx,De)-5]^ 


Next, we further hound the first term in the minimization of (12181 ) as follows 


(229) 


liminf min Id{Qx\\Px) — 

n^oo Qx€Pr^{X)■.RL>RL{Qx ,Di,) 


1 


n 


log 


|BS(e)|P [dE(V, V*) < De|V € TniMQx)) 

D {Qx\\Px) - 


(a) 

> lim inf min 

n^oo Qx6T„(A'):RL>itL(Qx,DL) 


1 


n 


logP 


= liminf 


dE(V,V*) < De|V g Tn{^,{Qx))\ -gie) 

D {Qx\\Px) - 


mm 

Qx€Pn(A’):RL>-RL(Qx,DL) 


^logP d^(y,V*) < De|V g TniMQx)) -g{e) 


n 

> liminf min \ D {Qx\\Px) + Rj,{Qx,Dc)} - 5 - g{e)\ 

n^oo (3xeT„(A’):RL>itL(Qx,DL) [ J 

(d) f 

> hminf mm < T) (T>e((5x)||-Px) + mm {R, i2E(Qx, De)} - 5 - (ii(e) - g(e) 

n^oo QxeT„(A^);RL>itL(Qx,DL) 


= liminf 


mm 


n-i>oo QxeT„o(A’);RL>-RL(Qx,DL) 


liminf 


mm 


n^-oo Qx6T„o(A’):Rl>/?l(Qx,Dl) 


D (^>e(Qx)||Px) + min{R,i?E(Qx, De)} - d- (5i(e) - ^(e) 


D{Qx\\Px) + min{R,i?E(Qx,DE)} -(5-(ii(e) - g{e) 


^ r, -n <T>(Qx||i^x) + min{R,iiE(Qx,DE)}-<5-(5i(e)-5(e) 

Qx^rnQ[^)-^L^^L{Qx^^L) I 1 

> liminf min < ZD (Qxl iP’x) + min {R, i?E(Qx, De)} - - (ii(e) - 5(e) 

n^oo QxGTn(A-):RL>itL(Qx,DL) 


(230) 


(231) 


(232) 

(233) 

(234) 

(235) 

(236) 

(237) 

(238) 


Inequality (a) follows from the fact that since 0 < e < 1, for all n sufficiently large |;SH(e)| < as in 

(120^ . 

Equality (6) is because ^ 1 as n —)• 00 . 

Inequality (c) is because there exists n 2 sufficiently large, such that for all n > n 2 the error probability of the 


any eavesdropper decoder a, 


n,^eiQx) 


satisfies 


-^logP V/V|VGrn($.(Qx)) >min{R,Z2E(Qx,DE)}-<5 
n L J 


(239) 


uniformly for all Qx G PnoiQx)- 
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Inequality (d) is by defining 


6i{e)^ma^\D{<^,iQx)\\Px)-DiQx\\Px)\ 

Qx 


(240) 


Note that since D{Qx\\Px) is a continuous function of Qx in Q(^) (as the support of Px is assumed to be 
X), it is also uniformly continuous. So, 5i(e) | 0 as e 0. 

• Equalities (e) and (/) are because ^e{Qx) € Vno{X) for all Qx € Vn{X). 

Substituting (12381) into (12181) . and using the fact Vn{^) C we obtain 


£■, (5, De) > min<^ 


mm 


Qx€S(A’):RL>i?L(Qx,DL) 


D {Qx\\Px) + min{R,i?E(<5x, De)} - giQ - 5i(e), 


min {D{Qx\\Px) + Re{Qx,D^)}}-S 

QxeQ(A'):RL<itL(Qx,DL) 


(241) 


> min< min < D {Qx\\Px) + R, 

[QxeS(A’):RL>i?L(Qx,DL) y 

min i D {Qx\\Px) + Re{Qx-, De) i > - (5 - 5i(e) - g{e) 

Qx&V{X) y J J 

> min{R,£’g(DE)} - 6 - (ii(e) - g{e) 


(242) 

(243) 


where in (a) we have used the definition in ([T^ . and the fact that the assumption El > 0 implies that Rl > 

Re(Px,DQ. 

Next, we analyze the required key rate. If Rl < iiL(Qx, Dl) then the required key rate is zero. Otherwise, if 
Rl > Re{Qx.i Dl) then the total key rate required to encode x G Qx is given by 

1 


n 


[(n - re)log|4:’| + log |;C(x,e)| + log|SH(e)| + nR] . 


Now, for all n sufficiently large 


— (n — n) log|A: |<-< o, 

n n 

-log|/C(x,e)| < -log|SH(e)| < 9{e), 
n n ' ' 


Thus, the required key rate is less than 


R + 2g{e) + 25. 


(244) 

(245) 

(246) 

(247) 


By taking e 0 we obtain p(e) 0 and 5i(e) 0, and so we obtain the achievability part of Theorem [T] 


D. Proof of Converse Part of Theorem [7] 

Following the outline of the converse, we begin with a lemma which constructs from a given sequence of codes 
S a new sequence S*, with constant key rate, which is less than R{S,Qx) + 5, and a zero excess-distortion 
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probability at the legitimate receiver. 

Lemma 13. Let S be an arbitrary sequence of secure rate-distortion codes, which satisfies a compression constraint 
(Rl, Dl, El). Also, let Qx G V{X) be given such that D{Qx\\Px) < El. Then, for every (5 > 0, there exists a 
sequence of secure rate-distortion codes S* such that: 

1) For all n and all x € Tn{Qx)> 5* has fixed key rate r*{x) = R* where R* < R{S, Qx) + 

2) For all n and S* = (fn^Tn) satisfies 

PK(x,<^;(/;:(x,u),u)) > Dl|x g TniQx)] = o, (248) 

and in addition, S* satisfies a compression constraint (R*, Dl, El) for R* = log|4:’|. 

3) For every Dg > Dl. 

f+(5,DE,Qx) <^J"(5 *,Dl,Qx) + 5. (249) 


Proof: We will prove this lemma by modifying the sequence of codes S into the new sequence S*. Assume 
that Qx G int Q(A’), and Qx G Pnoi^) for some minimal no G N. Since the statements in the lemma are only 
about conditional events given the type Qx, it is clear that the new secure rate-distortion codes constructed <S* 
need only be different from Sn for x G Tn{Qx), and so only block-lengths n mod no = 0 should be considered, 
as otherwise Tn{Qx) is empty. To wit, the limit n ^ oo should be read as limit / —oo for n = tiqI, but this 
will not be explicitly written, for the sake of brevity. Throughout the proof, quantities that are related to <S* will 
be superscripted by *. For brevity, we will denote the conditional key rate by R{Qx) and R*{Qx) for S and S*, 
respectively . 

Let (5 > 0 be given. For any length 0 < m < nloglAl and y € yn define the ambiguity sets for a given key-length 
as 

An{y, m) = {x G TniQx) ■■ kn{x) = m, /„(x, u) = y for some u G {0,1}”"} , (250) 


and with a slight abuse of notation define the ambiguity 5eo as 


n\og\X\ 

■^n{y) = y An{y,rn). 
m=0 


(251) 


For any given y and x G An(y), let us denote the reproduction w(x, y) = p{y, u), where u satisfies /^(x, u) = y, 
and fhe ambiguity set without excess-distortion 


Vn{y) = {x G An{y) : dL(x, w(x, y)) < Dl} . 


(252) 


'^Called residue class in the terminology of [T]. 
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Also, consider the modified ambiguity set 

{ n{R(Qx)-&) nlog|A'| '| 

^n{y)\ [J An{y,rn)\ [J An{y,m)\^Vn{y). (253) 

™=0 m=n(R{Qx)+S) J 

For a given y, the eavesdropper knows that x € An{y) and chooses its estimate accordingly. However, conditioned 
on y, the prohahility of X is not uniform over An{y), since A:„(x) is not the same for all x G An{y)- The proof 
of the lemma is divided into two steps and its outline is as follows. In the first step, we will identify a sequence 
of cryptograms {y^} which simultaneously satisfies the following properties: 

1) The conditional exiguous-distortion exponent of the eavesdropper when X is distributed uniformly over 
A*fiy^) is larger than the one for X distributed over An{yf) according to the distribution induced by Sn- 
2) The conditional exiguous-distortion exponent conditioned on y = y* equals the same exponent without this 
conditioning. 

In the second step of the proof, we utilize the set to construct the new sequence of codes S*. This is 

done by the same technique used in the achievability proof of Lemma |9] - by an efficient covering of the type 
class using permutations of one good set The two properties above of ?/* will be used to show that the 

exiguous-distortion exponent of S* may be only slightly less than that of S. 

We begin with the first step. For brevity, let us assume that X is distributed uniformly over the type class 
Tn{Qx), and probabilities, expectations and entropies will be calculated w.r.t. this probability distribution. So, we 
only consider y such that An{y) is non-empty. If we let 

A{y) ^ P \R{Qx) - 6 < r„(X) < R{Qx) + <5, W) < Djy = y] (254) 


then for n sufficiently large 


E [A(y)] = P [R{Qx) - <5 < r„(X) < R{Qx) + 6, d^^, W) < Dj 

> P [R{Qx) -6 <rn(X)< R{Qx) + d] - P [^^(X, W) > DJ 

> d-PK(X,W) > DJ 

> s - 2 -AEl-d(QxIIPx)-S] 

2 


(255) 

(256) 


where (a) is using the convergence in probability of r„(X) to R{Qx) (see (fTTI) ). and (6) is since S satisfies a 
compression constraint (Rl, Dl, El) and the assumption D{Qx\\Px) < El. Defining for any 0</3<l 

V«^|yGyn:4l(y)>/3-^|, 


(257) 
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then, since from the definition (12541 ) and (12561 ) 


0 < 


^(y) 


2 
< - 


E[^(y)] - s 

for all y G yn, the reverse Markov inequity (Lemma |2l) implies that 

1-/3 A 


ye 


n 1—2 


-13 


= CiS,/3), 


and choosing some /3* < min{l, |}, we obtain C*(<3) — C(<3, /3*) > 0 . Now, for 7 > 1, let 

- |y e : maxP [^(X, z) < Dgiy = y] < 7 • max P [^(X, Z) < Dg] 1 . 

Then the Markov inequality implies 


p(y ^ = p 


maxP [(iE(X, z) < Dgiy] > 7 - max P[(iE(X,Z) < De] 
^ 5-„GS„ 


(“) E[max^P[4(X,z) < DE|y]] 

“ 7 • max-^gg^ P [deCX, Z) < De] 

_ 1 

7 

where in (a) is should he recalled that z is chosen as a function of Y. Hence, hy the union hound 


p (y G n > 1 _ p ^ - p (y 0 v®) 


7 

Thus, for any given 6, there exists 7 * > 1 sufficiently large (hut independent of n) such that 

p (y G n > 0. 

Therefore, there exists a sequence {y^} such that for all n sufficiently large, y* G n Vn'^. 
In the second step of the proof, we descrihe the construction of S*. Note that hy letting 

U* = {u:3xG Al{y^) such that /n(x,u) = y];} 


(258) 


(259) 


(260) 


(261) 

(262) 

(263) 


(264) 

(265) 


(266) 


(267) 


and 


C:^{(^„(y;,u):uG(7*} 


(268) 


we have that 7l*(y*) C 'Y){C*,Qx, Dl). Now, recall that in Lemmaof the achievahility proof, we have utilized 
permutations of a D-cover Y){C*,Qx, Dl) (of a set C*) which cover the type class Tn{Qx), to construct a secure 
rate-distortion code. Following remark [TOl the set A^{yn) can also he used as a constituent set in the construction 
of a secure rate-distortion code, and the conditional exiguous-distortion exponent equal to the exponent achieved 
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when the source block X is distrihuted uniformly over as in (I176I ). Let us find the exponent achieved 

when X is distrihuted uniformly over (y*). To this end, denote 


M{5) ^ [n {R{Qx) - S) ,n {R{Qx) + S)] 


and observe that for an arbitrary eavesdropper z, and all n sufficiently large, 


maxP[dE(X,z) < Dgiy = y*] 

Z 

>P[dH(X,z)<DEly = y;] 

p[x = x|y = y:] 

xG>ln )-.dE (x,z) < De 
n\og\X\ 

= E E P[X = x|y = y;] 

m=0 xE-4Ti(y* ,?TT'):f^E(x,z)<DE 

ES''^' E«gA,(K,n.):J.(,.,)<D„ I*(X = X, F = y-J 

P (>" = Vn) 

X/mGAt((5) ,m);dE(x,z)<DE ^ Vn) 


> 


> 


P (^ = Vn) 

Xyxgyt„(y* ,m)nI>„(y*);dE(x,z)<DE ^ ^ Vn) 


^5 Y.meMiS) S 

= /3 
= /3 


P (y = y*) 


meA4(S) Z-^xG>tn(j/^,m)nI>„(y*):dE(x,z)<DE 


>(X = x,y = y* 


2 P [i?(Q^) - <5 < r„(X) < i2(gx) + <5, d^iX, W) < De, y = y*] 

d ^l 2 meA 4 (S) ^^xG^„(y* ,m)n 2 ?„(y*):dE(x,z)<DE ^ ^ 2/91) 

2 ' ~ 


SmeAt((5) X]xGyt„(9y* ,m)n2?„(y*) ^ ^ Un) 

S ^^mGAt(5) ^^xgyt„(y* ,m)nI?„(j/*):dE(x,z)<DE ^ ^ l/n) 

2 ' ~ 


Xym£At((5) XyxGyt„(9y* ,m,)n2?„(y*) ' 


■(X = x,y = y* 


^^mG^((5) ^^xG^„(y* ,m)n2?„(j/*):dE(x,z)<DE ^ ^nlX x) 

^ XymGAt(5) SxG>t„(j/* ,m)n2?„(y*) ^ l/nlX x) 

W 5 Em€M(d) • l{x £ An(y*,m) riVniVn) ■ 4(x,z) < De}| 

2 EmGAt(5)2"™- l-2ln(yn,m)nT>n(y*)| 

^ ^ J l{x e -4n(2/;;,m) nT>n(2/;;) : 4(x,z) < De}| 

2 2 -n(R(Q^)-S) . n P4y*)| 

_ 5 li^ £ -AniPn, m) 11 VniVn) '■ 4(x,z) < De}| 

2 Em€M(S) IA(yn,m) nPn(y*)| 

A^^.2-2n5p[^^(X*,z) < De], 

where (a) is because as y* G implies that 

P [i?(Qx) - -5 < r„(X) < R(Qx) + S, ^(X, W) < De, y = y^j 


/3| 


>F(r = y*), 


(269) 

(270) 

(271) 

(272) 

(273) 

(274) 

(275) 

(276) 

(277) 

(278) 

(279) 

(280) 
(281) 

(282) 

(283) 

(284) 


(285) 
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and {b) is because for admissible encoders and x € 

P (y = y;|X = x) = 2-^. (286) 

Thus, 

limsup — — logmaxP z) < Dg] > limsup — — maxlogP [dE(X, z) < DeIT" = y*] — 35 (287) 

n—>-oo ^ ^ n^oo ^ 

^=^^+(5,De,Qx)-35 (288) 

where (a) is because y* G So, by choosing 6 sufficiently small, we can achieve (12491 ) by the permutation 
construction of Lemma 0 

Finally, as the legitimate reconstruction w(x,y*) of any x G A*(i/*) satisfies di(x,w(x,y*)) < Dl, the 
permutation construction assures this property for all x G Tn{Qx)- So, it is easy to verify that if S has excess- 
distortion exponent El at distortion level Dl, then <S* has an even larger exponent. As R* = loglTf |, the compression 
constraint (R*, Dl, El) is satisfied by <S*. ■ 

We are now ready for the second and final step of the proof of the converse part of Theorem [T] 

Proof of converse part of Theorem [7} Let a sequence of secure rate-distortion codes S be given, which 
satisfies the compression constraint (Rl, Dl, El), and let 5 > 0 be given. From Proposition [3j it may be assumed 
that the eavesdropper is aware of the type of the source block Qx- Moreover, from Lemma [131 it may be assumed 
that Sn satisfies the three properties in Lemma [T3] for all Qx such that D{Qx\\Px) < El. Specifically, the first 
property implies that for some rate-function p ■. V{X) ^ M+ the code Sn has a fixed rate r„(x) = p{Qx) for all 
X G TniQx), and p{Qx) < R{S,Qx) +5, as long as D{Qx\\Px) < El. 

Let us first focus on a type Qx that satisfies D{Qx\\Px) < El, and a specific (type-aware) eavesdropper for 
Sn- The eavesdropper first produces a guess u of the key-bits u (with a uniform probability over {0, and 

then decodes w = (/?„(y,u). Since d^{-, •) is more lenient than di^f, •), and De > Dl, there exists a z G Z"" such 
that 


{x G A” : dL(x,w) < Dl} C {x G A” : d^{x,i) < Dl} 

C {x G A” : d^{x, z) < De} , 


(289) 

(290) 


and so the final eavesdropper estimate is z = z. For any n, let us bound the resulting conditional exiguous-distortion 
probability. 


P 


dE(X,Z) < DElXGrn(Qx) 


> p 
p 


tj = U|X G TniQx) 

4(X, Z) < De|X g TniQx),T = U 


(291) 




dE(X, Z) < De|X g TniQx), = U 


(292) 
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> 2—p(Qx) . p W) < De|X € Tn{Qx)] 


(293) 

(294) 


where (o) is from the second property assured for S in Lemma [T3] 

We now analyze the exiguous-distortion prohahility of S. Since \Vn{^)\< {n + 

Pd{Sn, Dh) = P [X G TniQx)] max P [^(X, Z) < De|X G TniQx)] 

Qx&V^iX) 

,-nD(Qx\\Px) . P[4(X,Z) < Dh|X G Tn{Qx)] 


= max e 
Qx(XP^{X) 


aGS„ 


= exp -n- min <D{Qx\\Px)- 

V Qx&v„{x) y 

- log max P [dE(X, Z) < De|X G Tn{Qx)] 
^ 5-„eE„ 


(295) 

(296) 

(297) 

(298) 


Now, let 0 < e < El he given, and let Q*x ^V{X) he such that 
^(Qxll^x)+limsup|--log max P[4(X,Z) < De|X G rn(Q3r)] < 

n—^oo 

1 


inf <^7)(Qx||i^x)+limsup<^-log max P [^(X, Z) < De|X G rn(Qx)] [>[>+e (299) 

Qx&V{X) y n—>cx) ( n o-„GE„ 


and let ttiq he sufficiently large so that 


sup {--log ma_x P[dE(X,Z) < De|X G Tn{Q*x)] 
n>mo y P (t„GS„ 


< limsup I-log max P [dE(X, Z) < De|X G Tn{Qx)] f" + ^- (300) 

n—>-oo ( n o-„GS„ 


Then, 


n—>-oo Qx&VniX) 


£’j'(5, De) = limsup min \d{Qx\\Px) -log max P [4(X, Z) < De|X G 7^((5x)] 


P CTriGEn 

1 


= lim sup min < D {Qx\\Px) -log max P[dE(X, Z) < De|X G Tn{Qx)] 

n>mQx&Vr.{X) y n a„GS„ 

= lim sup inf | D {Qx\\Px) - - log max P [^(X, Z) < De|X G Tn{Qx)] 

'^^°°n>mQx€V{X) ( 71 

< sup inf I D {Qx\\Px) - - log max P [dgCX, Z) < De|X G Tn{Qx)] 

n>mQ Qx€'P(Af) Tl crnGEn 

< inf |d(Qjis:||Px) + sup {--log max P[(iE(X,Z) < De|X G 7^(Qj)s:)] 
<{d{Q*x\\Px)+ sup {--log max P[dE(X,Z) < De|Xg rn(Q3r)] 

( n>mo y n (t„gS„ 

ib) f 

< inf \d{Qx\\Px) + 

QxGV{X) i ' 

limsup <-log max P [dE(X, Z) < De|X G 7^(<5j\:)] r r + 

n^oo y TL 5-„GS„ J J 


(301) 

(302) 

(303) 

(304) 

(305) 

(306) 

(307) 

(308) 
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= inf {D{Qx\\Px) + £US,^^,Qx)]+2e 
QxeP{x) 

(c) 

< inf {D{Qx\\Px)+£t(.S,D^,Qx)}+2e + 6 

id) 

< inf {D {Qx\\Px) P p{Qx)} P 2e + 5 

Qx€ViX):D{Qx\\Px)<Ei, 

(e) 

< R + 2e + 4(5, 


(309) 

(310) 

(311) 

(312) 

(313) 


where (a) is because, by assumption, if Tn{Qx) is empty then P[dE(X, Z) < De|X G Tn{Qx)] = 0 , (6) is from 
(12991 ) and (13001) . and (c) is from the third property of S promised by Lemma [13] The passage (d) follows from 
(12941 ). and so it remains to prove (e). To this end, recall that E[rn(X)] < R for all n was assumed. Define, for 
0 < e < El, the typical set 

f{Px,e) ^ {Qx G V{X) : D{Qx\\Px) < e} , (314) 

and with a slight abuse of notation, define Tn{Px,P) — T{Px,€^) H Vn{^)- Then, by fhe law of large numbers 

hm V P[XGrn(Qx)] = 1. (315) 

n^oo ^ 

Qx^Tn{Px,^) 

Now, assume by contradiction, that for all Qx G T{Px^^) we have p{Qx) > R + 3(5. Since by construction 
p{Qx) < Ri-S^Qx) P the uniform convergence of E[r„(X)|X € 7^(Qx)] to R(S,Qx) (see (fTTl) and fhe 
discussion fhaf follows) implies fhaf fhere exisfs no such fhaf for all n > no 


EK(X)|X G Tn(Qx)] > R(S, Qx) - S 

> p{Qx) — 26 

>R + d, (316) 


for all Qx G Tn{Px,Q- So, from (13151) . fhere exisfs m, such fhaf for all n > ni we have fhaf P X G Tn{Px, e) 
i+^/ 24 og|A-| ’ ^ max{no,ni} 


> 


E[r„(X)]= y] P[XGr„(Qx)]-EK(X)|XGr„(Qx)] 

QxePnix) 

> ^ e TniQx)] • EK(X)|X G TniQx)] 

Qx STT, (Px ,e) 


> min EK(X)|XGrn(Qx)] 

\QxGr 4 Px,e) ^ 

(“) , , 1 

> (R + (5)- 


y] P[XGr„(Qx)] 

QxSTnfPx.e) 


(317) 

(318) 

(319) 


1 + V 2 -log|-t^l 


(320) 
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(321) 

= R, 

(322) 


where (a) follows from (I316I ). However, this is a contradiction to the fact that Sn satisfies E [r„(X)] < R for all 
n. Thus, there must exist Qx G T{Px,^) C T{Px, El) such that p{Qx) < R + 35, which directly leads to (e) in 
(I3131) . Since e > 0 and 5 > 0 are arbitrary, the first term in the upper hound of (fT^ is proved, i.e. (5, Dg) < R. 

To prove the second term in the upper hound of (fT^ . i.e. Dg) < note that the eavesdropper can 

always ignore the cryptogram and blindly choose its estimate z (based only on the type Qx)- Thus, by similar 
arguments leading to (12291 ). it can be shown that for all n sufficiently large 

£+{S, D^,Qx) < Re{Qx, Dh). (323) 

The method of types, as in (12971 ) and the definition of £^*(De) in (fT^ . complete the proof. ■ 
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